|
Yep it acts like the password was just changed because it
sets the pwdLastSet value to the current date/time. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rich Milburn Sent: Tuesday, November 29, 2005 11:48 AM To: [email protected] Subject: RE: [ActiveDir] Quest Migration manager(OT) Yes, but I believe it
is set to 0, not 1. ----------------------------------------------------------------------- From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of Tom Kern Just curious, not i'm i want to implement this solution
but for my own knowldge, how does expiring accounts get around an
audit? If i expire and then unexpire an account, does the
password age go back to 1? is that it? thanks On 11/23/05, joe <[EMAIL PROTECTED]>
wrote: Yeah this is firmly
outside the realm of a script. The clear text passwords are only available
within the LSASS process itself so something has to be inserted into that
process space to get them, this is normally done with password change
notification routines which should be written in good solid c/c++ by people
knowledgable on Windows system level programming. There are third party
tools that will do this scraping for you as well as MIIS/IIFP as mentioned. I
don't know how free IIFP is but it certainly doesn't have additional cost
besides download time as long as you have a K3 Enterprise Box and SQL Server
laying about. I can't respond to the interface and intuitiveness comments
previouslly mentioned, I myself can't get my mind to pass by the SQL Server
requirement. Blackbox JET Blue backend would make me smile and load it near
immediately and maybe even work on tools to help make it better. :o)
The only official
"native" option I see is to prevent the passwords from changing but there is
pretty serious security concerns there, especially in the financial industry and
if you blow an audit because of not changing passwords on a frequent enough
basis that would be a bad thing. Of course there is the old hack to make it look
like passwords are being changed but they really aren't. You expire the accounts
and then unexpire them and voila they look like they just changed their password
and have a whole password expiration policy period to worry about them again.
Doing that gets you through your migration but you won't win any security admin
of the year awards. Of course you still have the issue with people who just
decided to change their password on their own. Simplest solution from
an admin standpoint would probably be to spin up a little change password
website and make everyone use it. Then the website sends the password to both
systems. Of course if your long
term goals are a password reset kiosk type thing for users to help themselves,
look at something like PSYNCH (
http://www.psynch.com/) which is designed to keep passwords in multiple
systems (and platforms) in sync with each other and offers the whole password
kiosk website and everything all together. You can use Q&A profiles, securID
auth, NT Password Auth, etc.
joe From: [EMAIL PROTECTED] [mailto:
[EMAIL PROTECTED]] On
Behalf Of Medeiros, Jose Hi Tom,
I know of no script
that can do this. Why don't you just not expire the password in the source
domain? The other option is to use a tool that will dump the passwords into a
text file such a pwdump. However Joe may have a better solution.
Sincerely,
|
- RE: [ActiveDir] Quest Migration manager(OT) joe
- RE: [ActiveDir] Quest Migration manager(OT) Brian Desmond
