Question about useraccountcontrol flags, specifically PASSWD_NOTREQD

[Guest]

I used Hyena to query my AD domain users for useraccountcontrol flags. According to Hyena a large number of user accounts have the PASSWD_NOTREQD flag.

However when I look at the properties of those users using Adsiedit.msc the PASSWD_NOTREQD flag is not listed.

Help!!

MS doc about PASSWD_NOTREQD and useraccountcontrol flags: http://support.microsoft.com/default...;en-us;Q305144

[kstanush]

Re: Question about useraccountcontrol flags, specifically PASSWD_NOTREQD

This is one of those account settings that Microsoft turns on by default when accounts are created. I am not sure if it can be turned off, but even then, we don't have a GUI option to enable/disable it anyway, and I've never seen a way to do it.

I did a search on Microsoft's site for the specific flag, which is named "uf_passwd_notreqd", and could not confirm this, but I am fairly certain that your domain policies override this setting. To test this, try entering a blank password for a test user account and see if Windows rejects the change.

This is a sort of 'hidden' flag, but its documented so we included it in the output, and now users are asking questions about it. You are not the first !

You won't see this flag in ADSIEDIT, as its part of the useraccountcontrol attribute, which is a bitmapped DWORD.

[Guest]

Re: Question about useraccountcontrol flags, specifically PASSWD_NOTREQD

Yes the AD domain password policy does override the uf_passwd_notreqd setting, however I'm not comfortable with accounts having this "no password required" setting.

Thanks for your help, Hyena is one of the most valuable tools I use!

[kstanush]

Re: Question about useraccountcontrol flags, specifically PASSWD_NOTREQD

Note that we never set this flag when creating accounts, but for some reason, Microsoft does set it. What I am unsure of is if it can be turned off once an account is created.

[Guest]

Re: Question about useraccountcontrol flags, specifically PASSWD_NOTREQD

It can be turned off manually by editing the UserAccountControl value. You need to subtract 32 from the number that is there then enter the new number into the field. For example if the UserAccountContol value is 544 with the no password required set then it should be changed to 512 and the password not required setting will be removed.

http://support.microsoft.com/default.aspx?scid=kb;en-us;Q305144

[Guest]

Re: Question about useraccountcontrol flags, specifically PASSWD_NOTREQD

Just type at cmd

net user guest /PASSWORDREQ:YES

and the guest account will require a password.