Interesting Issue with Major Implications
Hi ,
I had an interesting issue with a customer recently.
After a recent promotion of a couple of Domain Controllers , it came to light some time later that users were able to set their passwords to 0 e.g. minimum password length = 0.
On investigation what was discovered was the following.
When the Domain controller was promoted a secedit script was run. This had been part of a server build process for sometime. It was normally run on completion of the normal member server build was run.
What was included in the secedit.db script was the following critical entries to our discussion;
[Unicode]
Unicode=yes
[System Access]
MinimumPasswordAge = 0
MaximumPasswordAge = 42
MinimumPasswordLength = 0
PasswordComplexity = 0
PasswordHistorySize = 0
LockoutBadCount = 0
RequireLogonToChangePassword = 0
ForceLogoffWhenHourExpire = 0
Secedit configuration that was run
copy x:\abc\xxx\secedit.db c:\secedit.sdb /y
secedit /configure /db c:\secedit.sdb /cfg x:\abc\xxx\xxxabc.inf /overwrite /log x:\abc\xxx\error.log /quiet
attrib +h c:\secedit.sdb
This script was run using Domain Admins credentials
The result of running this command After the Domain Controller was promoted was the following Behaviour;
The Default Domain Account Security settings were overwritten by the “new” Secedit.sdb settings above. This overwrote the settings that are getting applied via the Account Security section in the Default Domain Policy.
Note this is expected behaviour because of the way Domain Controller reads its Security settings.
Information below taken from a Gary Olsen blog of 2005.
“Domain controllers provide security settings to domain users at logon time. This is a critical (and confusing) concept. The user's machine doesn't pull the security settings from the GPO at startup as it does for other machine settings. The client gets the security settings when the user is validated. The security settings that domain controllers apply to clients upon a successful user logon are those that are stored in the DC's local secedit.sdb security database. The DC gets the Account Security settings from the domain policy and applies them to its local .sdb. Note that this applies only to the account security settings, not to any other policy setting. DCs then replicate their local .sdb with each other.”
Note: If you modify block the Default Domain Policy applying to the Domain Controllers it is likely to exhibit this behaviour. Especially if the blocking or modification of the secedit.sdb is leaving the Domain Controller with insecure settings.
Therefore DO NOT run any modification to the secedit.sdb on a Domain Controller. Also do not block the application of the Default Domain Policy to the Domain Controllers OU. Please see previous blog links for further information.
It can potentially have serious implications.
https://blogs.technet.com/janelewis/archive/2007/04/24/just-don-t-do-it.aspx
Other useful links
https://technet.microsoft.com/ja-jp/library/cc730910(WS.10).aspx
https://support.microsoft.com/kb/313222
https://support.microsoft.com/kb/278316
Comments
- Anonymous
September 07, 2014
The comment has been removed - Anonymous
December 16, 2014
Your article is extremely fascinating and amusing. From your article. http://www.tattooinkstore.com">tattoo ink - Anonymous
December 16, 2014
The post is written in very a good manner and it entails many useful information for me. I am happy to find your distinguished way of writing the post.https://buyfakelikes.com/product/facebook-likes/ - Anonymous
December 16, 2014
The comment has been removed - Anonymous
December 16, 2014
I really enjoyed the quality information you offer to your visitors for this blog. I will bookmark your blog and have my friends check up here often.http://happychristmasandnewyear.com/best-christmas-gift-ideas-for-women/ - Anonymous
December 16, 2014
It’s very informative and you are obviously very knowledgeable in this area. You have opened my eyes to varying views on this topic with interesting and solid content.http://www.livcigs.com - Anonymous
December 16, 2014
No more fear or worry involved as it certainly exhaust your love and energy in this unpredictable market. For more info, click here my websitehttp://ledconceptslighting.genuineauditing.org - Anonymous
December 16, 2014
Wonderful illustrated information. I thank you about that. No doubt it will be very useful for my future projects. Would like to see some other posts on the same subject!http://chickencoopplansmanual.com/ - Anonymous
December 16, 2014
The comment has been removed - Anonymous
December 16, 2014
The comment has been removed - Anonymous
December 17, 2014
Your articles help us realize that our problems are typical, and we can solve them in constructive ways.Thank you and keep these good articles coming !http://gold-and-silver-buyers.com - Anonymous
December 17, 2014
I believe your blog is great because you are always uploading new information that is really informative as well as assists your readers.http://www.bioethanolfireplace.net - Anonymous
December 17, 2014
Excellent read, Positive site, where did u come up with the information on this posting?I have read a few of the articles on your website now, and I really like your style. Thanks a million and please keep up the effective work.http://autolackierung.in/ - Anonymous
December 17, 2014
Fantastic work. This post possesses a real spirit of knowledge. The knowledge here seems unique and I have never known this kind of information in my entire life. This is a very rare post. You should definitely get an award for this.http://www.floorsandchores.net/moving-helpers.html - Anonymous
December 17, 2014
We definitely taking pleasure in every single bit of this. It is just a great internet site and good write about. I wish to appreciate it. Great task! You guys perform a great blog, and have some great articleshttp://followfy.com - Anonymous
December 17, 2014
Without a strong backing, you don’t stand much of a chance, so why not buy Instagram followers and seriously boost your online presence.http://dripfollowers.com - Anonymous
January 09, 2015
Please accept our thanks and congratulations on the success of your recent series on young scholars in our community. upbeat report on the good things that are happeninghttps://www.change.org/p/stephen-brook-5-essential-modeling-must-haves - Anonymous
January 12, 2015
I will share it with my social networks because i enjoy posting that informatione.
http://caps.fool.com/Blogs/which-modeling-path-is-right/1022182">bubblegum casting - Anonymous
January 16, 2015
Im no expert, but I believe you just made an excellent point. You certainly fully understand what youre speaking about, and I can truly get behind that.
blog comments - Anonymous
January 20, 2015
Hey what a brilliant post I have come across and believe me I have been searching out for this similar kind of post for past a week and hardly came across this. Thank you very much and will look for more postings from you.
rebelmouse - Anonymous
January 21, 2015
I am really happy with your stuff provide. I like to bookmark it and i hope in future you w ill keep update us
https://www.fiverr.com/seo_builder1/do-submission-of-exclusive-sixty-five-comments?funnel=201501212122015134444960">blog comment service - Anonymous
January 28, 2015
I enjoyed reading your post and found it to be informative and to the topic. Thank you for not rambling on and on just to fill the page. Thanks..https://www.it-sh.ro - Anonymous
January 28, 2015
Excellent read, Positive site, where did u come up with the information on this posting?I have read a few of the articles on your website now, and I really like your style. Thanks a million and please keep up the effective work.
http://seagullelectronics.com/">Home Automation Jupiter Island - Anonymous
January 28, 2015
The comment has been removed - Anonymous
January 28, 2015
The comment has been removed - Anonymous
February 10, 2015
The post am professionally written AS WELL AS we feel just like the author has extensive knowledge inside this subject. Nice post.
http://sextoyanonymous.com/">girlsdoporn - Anonymous
February 10, 2015
The comment has been removed - Anonymous
February 16, 2015
The comment has been removed - Anonymous
February 21, 2015
Thanks for sharing so significative article with us. Wonder Know is a comprehensive website that provides all kinds of articles.
http://pornwikileaks.org/miss-teen-colorado-runner-up-exposed/">girlsdoporn - Anonymous
February 25, 2015
If you are looking for a heating and air conditioning company in the Tulsa County area, Our professional technicians can help you select, install, and maintain equipment to assure efficiency, reliability, and comfort over the lifetime of your products
modelle - Anonymous
March 05, 2015
Wow! I am glad after reading that post. I am always searching online for articles that can help me. There is obviously a lot to know about this. I think you made some good points in Features also.thanks a lotagesonghv.com - Anonymous
March 06, 2015
Awesome and interesting article. Great things you've always shared with us. Thanks. Just continue composing this kind of post.http://www.bebenou.ro/ - Anonymous
March 16, 2015
Hey I am from USA for the first time he . I came across this board and I in finding It truly useful & it helped me out much. Thank Youhttp://supermarijoigre.com - Anonymous
March 17, 2015
Thanks for the nice blog. It was very useful for me. Keep sharing such ideas in the future as well.Kits - Anonymous
March 18, 2015
I am always searching online for articles that can help me. There is obviously a lot to know about this. I think you made some good points in Features also reverse phone number searchoperatives - Anonymous
March 20, 2015
I am always searching online for articles that can help me. There is obviously a lot to know about this. I think you made some good points in Features also. Keep working, great job!world - Anonymous
March 24, 2015
I beloved as much as you will obtain performed proper here. The caricature is attractive, your authored subject matter stylish. however, you command get bought an edginess over that you want be handing over the followingorganic - Anonymous
March 24, 2015
I beloved as much as you will obtain performed proper here. The caricature is attractive, your authored subject matter stylish. however, you command get bought an edginess over that you want be handing over the followinghttp://organicdesignoperatives.com/">organic - Anonymous
April 07, 2015
This is such a great resource that you are providing and you give it away for free. I love seeing websites that understand the value of providing a quality resource for free. It is the old what goes around comes around routine.
https://www.rebelmouse.com/hsveraserreviews/ - Anonymous
April 15, 2015
I remember the Star report that gave the full Monica Lewinsky story used POTUS often as a wayhttp://www.youtube.com/watch?v=UBtVdeNlLmw">http://www.youtube.com/watch?v=UBtVdeNlLmw - Anonymous
April 16, 2015
You’ve got some interesting points in this article. I would have never considered any of these if I didn’t come across this. Thanks!.
Benidorm Trip Advisors - Anonymous
April 20, 2015
The comment has been removed - Anonymous
April 27, 2015
I am very thankful to you that you uploaded this today. I was in dire need to get some information on this topic and you’ve given me thathttp://sellingmesaarizonahomes.com/laveen-homes-sale/">laveen homes for sale - Anonymous
April 27, 2015
I must say, as a whole lot as I enjoyed reading what you had to say, I couldnt assist but shed track of time soon after a while.Piedmont Area Rocketry - Anonymous
May 02, 2015
This topic has always been one of my favorite subjects to read about. I have found your post to be very rousing and full of good information. I will check your other articles shortly.Advanted - Anonymous
May 02, 2015
This topic has always been one of my favorite subjects to read about. I have found your post to be very rousing and full of good information. I will check your other articles shortly.Advanted - Anonymous
May 06, 2015
The deegant Pandora clips are fascinating for the Fashion lady .You can find the particular Pandora clips all over the world. Choose the Pandora clips,choose the fashion.Welcome you to our pandoraok.com.We hope you can find your best love. - See more at:http://independent.co.ug/column/comment/4995-an-alternative-policy-response-to-ugandas-economic-challenges-#sthash.bgmZMhSp.dpufhttp://cursosinem.info/cursos-inem-cordoba.html">cursos sepe - Anonymous
May 06, 2015
This is such a great resource that you are providing and you give it away for free. I love seeing websites that understand the value of providing a quality resource for free. It is the old what goes around comes around routine.http://cursosinem.info/cursos-inem-caceres.html">inem .es - Anonymous
May 07, 2015
Your article tells me you must have a lot of background in this topic. Can you direct me to other articles about this? I will recommend this article to my friends as well. ThanksYouth - Anonymous
May 07, 2015
This topic has always been one of my favorite subjects to read about. I have found your post to be very rousing and full of good information. I will check your other articles shortly.http://cursosinem.info/cursos-inem-burgos.html">cursos gratis online - Anonymous
May 19, 2015
Existing without the answers to the difficulties you’ve sorted out through this guide is a critical case, as well as the kind which could have badly affected my entire career if I had not discovered your web site.bola tangkas online - Anonymous
May 20, 2015
I’m excited to uncover this page. I need to to thank you for ones time for this particularly fantastic read !!http://gattoascona.club/index.php/en/osteria-del-gatto-3">Harley Ascona - Anonymous
May 21, 2015
Really appreciate this wonderful post that you have provided for us.Great site and a great topic as well i really get amazed to read this.http://www.sibutril.ws/fr/">acheter sibutramine - Anonymous
May 21, 2015
The comment has been removed - Anonymous
May 26, 2015
Im no expert, but I believe you just made an excellent point. You certainly fully understand what youre speaking about, and I can truly get behind that.
https://twitter.com/girlsdoporn">girlsdoporn - Anonymous
May 26, 2015
Im no expert, but I believe you just made an excellent point. You certainly fully understand what youre speaking about, and I can truly get behind that.
https://twitter.com/girlsdoporn">girlsdoporn - Anonymous
June 14, 2015
Excellent read, Positive site, where did u come up with the information on this posting?I have read a few of the articles on your website now, and I really like your style. Thanks a million and please keep up the effective work.http://www.china-clothing-manufacturer.net/" target="_blank">clothing manufacturer - Anonymous
July 02, 2015
The comment has been removed - Anonymous
September 13, 2015
This was a really great contest and hopefully I can attend the next one. It was alot of fun and I really enjoyed myself..
#MasterSEO: https://www.distributorseo.co.id/">Jasa Seo Murah Berkualitas - Anonymous
September 13, 2015
Amazing! Its genuinely awesome piece of writing.
site: http://www.distributorseo.co.id - Anonymous
September 25, 2015
An impressive share! I have just forwarded this onto a friend who was conducting a little homework on this.
And he in fact ordered me lunch simply because I stumbled upon it for
him… lol. So let me reword this…. Thanks for the meal!!
But yeah, thanks for spending some time to discuss this subject here
on your blog. http://faedahjaya.com - Anonymous
September 25, 2015
Hi there, every time i used to check webpage posts here in the early hours in the daylight, since i like
to find out more and more. http://www.iklantemanggung.com - Anonymous
October 05, 2015
Wow what a Great Information about World Day its very nice informative post. thanks for the post.http://www.downeastcoconut.com">http://www.downeastcoconut.com - Anonymous
October 07, 2015
Do not obtain mentally purchased exactly what’s happening and also simply
aim to overlook it. http://panamaliving-realestate.com">panama - Anonymous
October 10, 2015
Excellent blog you have got here.. It’s hard to find quality writing like yours these days.
I really appreciate individuals like you! Take care!! http://www.distributorpulsa.co.id - Anonymous
October 10, 2015
Hello friends, good piece of writing and fastidious arguments commented at this place, I
am actually enjoying by these. http://www.distributorhosting.co.id - Anonymous
October 18, 2015
This topic has always been one of my favorite subjects to read about. I have found your post to be very rousing and full of good information. I will check your other articles shortly.http://panamaliving-realestate.com">panamaliving-realestate.com - Anonymous
October 19, 2015
Hello ! I just wish to give an enormous thumbs up for the nice info you've got right here on this post. I will probably be coming back to your weblog for more soon.http://healthynovato.org">Healthy - Anonymous
October 25, 2015
A very awesome blog post. We are really grateful for your blog post. You will find a lot of approaches after visiting your post. I was exactly searching for. Thanks for such post and please keep it up. Great work.http://www.bonniebrulee.com">http://www.bonniebrulee.com - Anonymous
October 28, 2015
It is usually wise to time to analyse every one of the business tips and options before choosing anybody. After almost all, you are buying a franchise option that may pay you in the end. http://www.refinancebest.com">www.refinancebest.com - Anonymous
October 29, 2015
It is one of the best information which you are providing. I love your blog because it totally full of informative posts. You are nice one and thanks for sharing.http://www.philomathrotary.org">Philomath Club - Anonymous
December 19, 2015
Thanks for the discuss. Liked all the details you that you have mentioned to us, very useful and effective!http://eastcoastautocrafting.com">eastcoastautocrafting.com - Anonymous
January 27, 2016
I was verifying consistently this web blog and I’m impressed! Extremely details specifically the last part I care for such information and facts much. I was searching for this certain details for some timehttp://www.franchiselaundry.com - Anonymous
January 27, 2016
The comment has been removed - Anonymous
February 15, 2016
Really appreciate this wonderful post that you have provided for us. http://en.community.dell.com/members/gmodfree">download gmod free