This will change the password policy for all existing users:

net accounts /maxpwage:30

I only want to change the password policy for the one user. How do I do that?

  • The external vendor abusing admin rights while they have them is not a concern. The reason I was given: they work in tandem with the day-to-day, and have a litany of contracts to hold them in place. Whether I agree doesn't matter. I've edited to pare down to my essential question. – undrline Nov 8 '18 at 20:31
  • Is the computer in a domain or no domain? – Twisty Impersonator Nov 8 '18 at 20:54
  • @TwistyImpersonator it is remotely accessed via tools like teamviewer/logmein/etc ... every center is its own isolated network, setup however, and I wouldn't be making use of things like ActiveDirectory. – undrline Nov 8 '18 at 21:00
  • I'm not asking if you have access to AD, but whether the device is a domain member. The answer significantly affects how password policies work. – Twisty Impersonator Nov 8 '18 at 21:01
  • 1
    Note that this is simply impossible for non-domain users. It is only possible for domain users logged into domain-member computers. Is that possible for you? – Twisty Impersonator Nov 8 '18 at 21:04

The feature Password expires only works with the policy Password expires. So you need to set that too, which indeed is set for every user unless they have Password Never Expires set to true. But that only makes it so that they get to change the password after it expires, which is not what you want. They can also just edit their user and disable this if they want, given they're admin on that machine.

Instead, you can set an end date on the account itself and basically it can't be used after that date. This feature is unfortunately only part of a domain user, not a local user, but this really is the best way to do this.

An alternative is to create a script that disables the user, and setup a task using Task Scheduler to execute that script at a given time. This has its caveats too, as they can disable it if they find it.

If they access the machines through RDP remotely the easiest is to setup a 2nd port forwarding to the machines, probably through 1 pc with a different port, then you can just disable that port forwarder

  • I would like to point out that very rarely does anyone actually need Administrator permissions. You can create a user group, that can install software, you don't have to literally provide full administrator access to a third-party. If you are using Active Directory domain, just remember you can simply create a local profile, that only exists on that machine. This would prevent that local account from accessing your network, provided your configuration, allows for you to only allow access to domain users. – Ramhound Nov 8 '18 at 19:51
  • @Ramhound if you setup the user correctly in Active Directory, you can disallow network access from there too. The difference between a local user and a domain user is the fact that if you have to do this for 100 machines, you need to visit every machine for every change, whereas with a domain user, you manage everything centrally, which is what you normally want in this case. As for requiring administrative privileges, it depends, some programs use a service and then you really do need administrative privileges. – LPChip Nov 8 '18 at 20:03
  • I didn't see it was "remote machines" which makes using a local account more difficult. My comment was more of, "does this third-party actually need Administrator right or are they simply asking for it", more of a thought activity to the author. – Ramhound Nov 8 '18 at 20:08
  • @Ramhound right. :) I guess your 2nd comment will be helpful here. :) – LPChip Nov 8 '18 at 20:10
  • @LPChip well said ... they are using a service. I was using the term "software" very loosely. Please see my comment above about a possible workaround ... does PasswordExpires only have two states, or is there technically a not set or null state? What is the default? – undrline Nov 8 '18 at 21:47

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.