45
Interactive logon: Prompt user to change password before expiration
Member Server Default
Legacy Client
Enterprise Client
High Security Client
14 days
14 days
14 days
14 days
The
Interactive logon: Prompt user to change password before
expiration
security option setting
determines how many days in advance users are warned that their passwords are about to expire.
The Account Policies section of this guide recommends configuring user passwords to expire
periodically. If users are not notified when their passwords are about to expire, they may not realize it
until the passwords have already expired. This could lead to confusion for users accessing the
network locally, or make it impossible for users who are accessing the company’s network via dial-up
or virtual private networking (VPN) connections. Therefore, this setting is configured to the default
setting value
14 days
in the three environments defined in this guide.
Interactive logon:
Require Domain Controller authentication to unlock workstation
Member Server Default
Legacy Client
Enterprise Client
High Security Client
Disabled Enabled Enabled Enabled
Important:
This setting applies to computers running Windows 2000 or later, but it is not available
through the Security Configuration Manager tools on computers running Windows 2000-only
Windows Server 2003.
For domain accounts, the
Interactive logon: Require Domain Controller authentication to unlock
workstation
security option setting determines whether a domain controller must be contacted to
unlock a computer. This setting addresses a vulnerability similar to the
Interactive logon: Number of
previous logons to cache (in case domain controller is not available)
setting. A user could disconnect
the network cable of the server and unlock the server using an old password without authenticating to
unlock the server. To prevent this, this setting is configured to
Enabled
in the three environments
defined in this guide.
Microsoft network client: Digitally sign communications (always)
Member Server Default
Legacy Client
Enterprise Client
High Security Client
Disabled Disabled Enabled Enabled
Important:
In mixed environments with legacy clients, set this option to
Disabled
as these clients will
not be able to authenticate or gain access to domain controllers. However, this setting should be
Enabled within Windows 2000 or later environments. The Enterprise Client and High Security
environments defined in this guide only contain systems running Windows 2000 or later, which
support signing digital communications. Therefore, to increase communications security between
systems in this environment, this setting is configured to
Enabled
in the Enterprise Client and High
Security environments. This setting must be set to
Disabled
for HP NAS server systems within multi-
protocol network environments involving NFS, AFTP, or NCP.
The
Microsoft network client: Digitally sign communications (always)
security option setting determines
whether packet signing is required by the SMB client component. Enabling this setting prevents the
Microsoft network client from communicating with a Microsoft network server unless that server agrees
to perform SMB packet signing.
