1

In the domain of our organisation there is a server, which has "password max age" enabled, which forces the users to regulary change their passswords.

The Server seems to cache the old passwords, so that i can not reuse them anymore.

  • How long does the Server remember the old passwords?
  • Does the system remember a limited amount of old passwords?
  • Is there a way for me, as a user without an access to the active directory - to keep my old password?

2 Answers 2

1

These are all group policy settings

They have been set by your administrators. It's also not one server with this option set, but all the domain controllers in your domain. They replicate these settings between each other and are responsible for authentication when you log in to the network.

Viewing Group Policy

You can take a look at group policy by opening Group Policy Management. It's unlikely that it's installed on your machine, but if you have permissions to install programs you could install RSAT, though I'm not sure you'd want IT to catch you doing this as it could be misconstrued as malcious.

I was surprised to find this on our terminal server (or Remote Desktop Server for you pedants out there.) I logged in as a random user whose password I happen to know and voila, I could see all our group policy objects and inspect their settings.

Password policies

What you're looking for is the Default Domain Policy. Drill down in to Windows Settings, Security Settings, and Account Policies/Password Policy and you'll be able to see the password settings:

enter image description here

Keeping the old password

There probably isn't a way for you to keep your old password. On second thought, you don't mention password history. If there is no password history, change your password and then change again to the old one. You really should just man up and learn the new one though. If there are no complexity requirements, try using a few words instead of strange subsititions.

0

All of your bullets are things that can be set via Group Policy (GPO) on the domain controllers, assuming you are using a domain controller. If not, then it can be set in the Local Group Policy of the machine.

You can find the settings in Computer Configuration -> Windows Settings -> Security Settings -> Account Policies -> Password Policy

You can set password history, maximum age, minimum age, minimum length, complexity requirements and even if you want to allow passwords to be stored with reversible encryption.

If the password history is set to '0' then it will not keep a password history. If it is set to '1' then you can change the password then change it back to the original again, albeit, this is a security setting in place for a reason.

In a nutshell, the question you are asking is attempting to circumvent an IT policy in place for security purposes. It is a hassle but I recommend keeping within the confines of the policy.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .