RE: [ActiveDir] Seperate Administrator password policy

[Bahta, Nathaniel V CTR USAF NASIC/SCNA]

What does that have to do with reading how many characters someones password is?  I know how to find out the minimum password lengths value, but that is not what we are concerned with.  We are concerned with how long the actual password is.  Be it 15 or 20 or 8 characters, that is what we are looking for.  If I wanted to read AD attributes this would be fairly elementary, hardly worth a google search. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Za Vue Sent: Friday, September 01, 2006 6:28 AM To: ActiveDir@mail.activedir.org Subject: Re: [ActiveDir] Seperate Administrator password policy Come on.. You mean searching for a _vbscript_ to check password length yields nothing on Google.com? Here is a start: ================================== Dim User Dim UserName Dim UserDomain UserDomain = "DomainToManage" UserName = "UserName" Set User = GetObject("WinNT://" & UserDomain & "/" & UserName & ",user") Response.Write user.PasswordMinimumLength ================================== Perhaps username can be changed to domain admins and use GPO to apply to the admin group? Anyway, I am sure some can finish the rest. -Z.V. NOTE: Make sure you have the latest scripting engines on the workstation you run this script from. Download the latest scripting engines here: Microsoft Scripting Home Page Bahta, Nathaniel V CTR USAF NASIC/SCNA wrote: Yeah thats what me and my coworkers have been debating, what method to use to check password length.  We are looking through perl modules to see if there are any that can actually do what we are talking about.  So far no luck with it, but the search continues.  Do you know of any module that does what we speak of?  From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of joe Sent: Thursday, August 31, 2006 7:13 PM To: ActiveDir@mail.activedir.org Subject: RE: [ActiveDir] Seperate Administrator password policy How are you guys checking password length after the fact?   -- O'Reilly Active Directory Third Edition - http://www.joeware.net/win/ad3e.htm      From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Katrin Wilhelm Sent: Thursday, August 31, 2006 6:05 PM To: ActiveDir@mail.activedir.org Subject: RE: [ActiveDir] Seperate Administrator password policy I agree to Za, But adjust the script so that it automatically locks the account should it not be 15 characters long – then they have to change it. Just and idea from a newbie. Kat From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Za Vue Sent: Thursday, 31 August 2006 10:39 PM To: ActiveDir@mail.activedir.org Subject: Re: [ActiveDir] Seperate Administrator password policy Would it be easier just to ask them to use 15 characters?  Run a small script to check on the numbers of characters after the passwords have been changed. If under 15 than ask them to change it again. -Z.V. Almeida Pinto, Jorge de wrote: third party software could be an option for example: http://www.anixis.com/products/ppe/default.htm jorge From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Bahta, Nathaniel V CTR USAF NASIC/SCNA Sent: Thursday, August 31, 2006 14:15 To: ActiveDir@mail.activedir.org Subject: [ActiveDir] Seperate Administrator password policy Just wanted to field this to see if it makes any sense to any of you guys.  We are going to implement a mandatory 15 character password policy for all of our administrator accounts.  The only way that makes sense is a subdomain with a separate password policy, since there is only one per domain.  I also know that I have to edit the minPwdLength attribute and the uASCompat attribute to make this work on the subdomain.  Can anyone think of another method of doing this? Thanks, Nate Bahta This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.