Administrator account and lockout policy

[RayRogers]

I have account lockout policy applied to the domain. I created an account
(not a default administrator account) which is member of domain admin, is
there a way to have this admin account exempt from this lockout policy?
Thanks!

 

[Dobromir Todorov]

Not before Windows 2008 - as there is a single domain password policy for
all users.

You can in Windows 2008 - see this link for more details:
http://technet.microsoft.com/en-us/magazine/cc137749(TechNet.10).aspx

--
---
HTH,
Dobromir

Learn more about Security and Identity Management:
Visit http://www.iamechanics.com

"RayRogers" <RayRogers@news.postalias> wrote in message
news:C4F80131-F580-4936-A781-BDA313B9748D@microsoft.com...
>I have account lockout policy applied to the domain. I created an account
> (not a default administrator account) which is member of domain admin, is
> there a way to have this admin account exempt from this lockout policy?
> Thanks!

 

[RayRogers]

Thank you very much for the info.

"Steve Riley [MSFT]" wrote:

> I'd encourage you not to use account lockout. I know that some of our
> published guidance recommends it, but that was written some time ago.
> Account lockout is expensive -- the average cost per call to a help desk is
> $70. Plus, it creates a situation in which an attacker can intentionally
> lock out some or all of your users -- a kind of denial of service attack. So
> long as you're using good (by that I mean long) passphrases, then you really
> don't need account lockout.
>
> --
> Steve Riley
> steve.riley@microsoft.com
> http://blogs.technet.com/steriley
> http://www.protectyourwindowsnetwork.com
>
>
>
> "RayRogers" <RayRogers@news.postalias> wrote in message
> news:C4F80131-F580-4936-A781-BDA313B9748D@microsoft.com...
> > I have account lockout policy applied to the domain. I created an account
> > (not a default administrator account) which is member of domain admin, is
> > there a way to have this admin account exempt from this lockout policy?
> > Thanks!
>