Prevent Admin account lockouts

[MordyT]

Hi there,

Doing a project for a non-profit educational institution and we having an issue.

 

Running on Server2003 SBS. Policy is to lockout a account until manually unlocked after 5 failed attempts.

 

There is a concern that a person will deliberately lock out all the admin accounts in the domain. Short of having a hidden account that we will be able to login with, is there a way to prevent admin accounts from being locked until unlocked?

[FN-GM]

Hi there,

Doing a project for a non-profit educational institution and we having an issue.

 

Running on Server2003 SBS. Policy is to lockout a account until manually unlocked after 5 failed attempts.

 

There is a concern that a person will deliberately lock out all the admin accounts in the domain. Short of having a hidden account that we will be able to login with, is there a way to prevent admin accounts from being locked until unlocked?

 

The original administrator account doesn't lockout. You can set it to automatically unlock accounts after a period of time if you like.

[MordyT]

Hi,

we have the system set to auto-unlock accounts after 30 minutes.

I guess we are looking for a way to be able to trigger a unlock, external of the network, on just admin accounts.

[Duke5A]

Short of having a scheduled task run dsmod to unlock an account every so often, I don't see how. 2000/2003 AD doesn't support multiple account/password policies; you can only do that with 2008.

[Michael]

Rename the admin accounts and remove any lockout policies on 2003 server. On 2008 you can specify different policies (as mentioned above).