JSI Tip 9765. The NTLM network authentication behavior has been modified in Windows Server 2003 SP1?

After applying Service Pack 1 for Windows Server 2003, domain users can use their old password to access the network for a nadministrator definable time period after the password has been changed.

NOTE: Kerberos authentication is unaffected by this behavior change, as is interactive logon behavior.

The default old password lifetime period is 60 minutes. To alter the lifetime period for old passwords, I have scripted OldPasswordAllowedPeriod.bat.

The syntax for using OldPasswordAllowedPeriod.bat is:

OldPasswordAllowedPeriod Minutes

Where Minutes is the number of minutes for the lifetime period for old passwords.

NOTE: This script can be run on a Windows Server 2003, or on a Windows XP domain member with the Windows Server 2003 adminpak.msi installed.

OldPasswordAllowedPeriod.bat contains:

@echo offif {%1}=={} @echo OldPasswordAllowedPeriod Minutes&goto :EOFif %1 NEQ +%1 @echo OldPasswordAllowedPeriod Minutes - %1 is not numeric&goto :EOFsetlocalset key=HKLMSYSTEMCurrentControlSetControlLsaset /a minutes=%1for /f "Tokens=1" %%c in ('DSQUERY SERVER -O RDN') do ( @echo REG ADD \%%cHKLMSYSTEMCurrentControlSetControlLsa /V OldPasswordAllowedPeriod /T REG_DWORD /F /D %minutes% REG ADD \%%cHKLMSYSTEMCurrentControlSetControlLsa /V OldPasswordAllowedPeriod /T REG_DWORD /F /D %minutes% @echo.)endlocal