Can we force Windows to choose random passwords for accounts created in 2003 Active Directory? Can we force the user to then change their password on login?
In Active Directory Users and Computers expand the local domain, if you open your company users OU, depending on were you created your users.
Right click on the user's account and select properties to open the users properties dialog box
On the Account's tab under Account options field
You can select the check box "User must change password at next log on"
select apply and OK
Note that this option is not permanent, as the option is disabled once the user has successfully changed the password and logged on
It is also worth noting that if you want your users to have a 'random' password that any domain password settings are done through the default domain policy in Group Policy Management. Any change made here will affect ALL users. It is possible in 2008 to set up multiple password policies but its a bit of a nightmare working out how many milliseconds from the year 1600 it's been. No i'm no kidding.
Last Wiki Answer Submitted: June 8, 2011 3:27 pm by Guardian900 pts.
If you live outside the United States, by submitting your email address you consent to having your personal data transferred to and processed in the United States.
Also keep in mind that if you force users to use truly random passwords your help desk is going to get a lot of calls about password problems, and people are going to have their passwords written down on their desks, making the passwords totally useless.
If you want something secure that remains useful, look into using RSA tokens for authentication. Half the password the user knows, and the other half they read from the token and it changes every minute. (Some of the root keys for RSA were compromised recently, so make sure that you get a device with the new keys.)
Also keep in mind that if you force users to use truly random passwords your help desk is going to get a lot of calls about password problems, and people are going to have their passwords written down on their desks, making the passwords totally useless.
If you want something secure that remains useful, look into using RSA tokens for authentication. Half the password the user knows, and the other half they read from the token and it changes every minute. (Some of the root keys for RSA were compromised recently, so make sure that you get a device with the new keys.)
Great point, thanks mrdenny.