Vista Tutorial - Local Vista User Account using Domain Security Pol?

permalink · 03-31-2008

Ok, Simple question.

I have a Local User Account created on a Vista Business computer. This
Vista system is on our Domain. I need to have this local account NOT
use the Domain password policies.

I am NOT able to go in and edit or change these with the Local
Security Policy (They are grayed out).
I am using a Domain Admin account.

How do I change this?

All I really want to do is remove these for this local account

permalink · 04-01-2008

This happens when you have a GPO applied to an OU that contains this
computer, and the GPO sets password policy. In other words, locally, no you
can't do anything as this is enforced using GPOs.

If you are the domain admin, however, you can restructure your GPOs. One
option would be to create a new OU for computers that should not have this
policy. Then either make sure this GPO does not apply to that OU, or set a
new GPO that overrides this one.
---
Your question may already be answered in Windows Vista Security:
http://www.amazon.com/gp/product/047...otectyourwi-20

"Noob" wrote:

Quote:

> Ok, Simple question.
>
> I have a Local User Account created on a Vista Business computer. This
> Vista system is on our Domain. I need to have this local account NOT
> use the Domain password policies.
>
> I am NOT able to go in and edit or change these with the Local
> Security Policy (They are grayed out).
> I am using a Domain Admin account.
>
> How do I change this?
>
> All I really want to do is remove these for this local account
>

permalink · 04-01-2008

Correct me if I'm wrong, but I believe that there is only one password
GPO for a domain. You can't have different ones for each OU...

--

Regards,
Hank Arnold
Microsoft MVP
Windows Server - Directory Services

Jesper wrote:

Quote:

> This happens when you have a GPO applied to an OU that contains this
> computer, and the GPO sets password policy. In other words, locally, no you
> can't do anything as this is enforced using GPOs.
>
> If you are the domain admin, however, you can restructure your GPOs. One
> option would be to create a new OU for computers that should not have this
> policy. Then either make sure this GPO does not apply to that OU, or set a
> new GPO that overrides this one.
> ---
> Your question may already be answered in Windows Vista Security:
> http://www.amazon.com/gp/product/047...otectyourwi-20
>
>
> "Noob" wrote:
>

Quote:

>> Ok, Simple question.
>>
>> I have a Local User Account created on a Vista Business computer. This
>> Vista system is on our Domain. I need to have this local account NOT
>> use the Domain password policies.
>>
>> I am NOT able to go in and edit or change these with the Local
>> Security Policy (They are grayed out).
>> I am using a Domain Admin account.
>>
>> How do I change this?
>>
>> All I really want to do is remove these for this local account
>>

permalink · 04-01-2008

On Tue, 01 Apr 2008 04:22:32 -0400, Hank Arnold (MVP) wrote:

Quote:

> Correct me if I'm wrong, but I believe that there is only one password
> GPO for a domain. You can't have different ones for each OU...

Jesper is talking about GPOs that contain password policies that are linked
some where other than at the domain level. Such GPOs will not affect domain
accounts but will affect accounts in the local SAM of any computer which
processes such GPOs.

Quote:

>
> Jesper wrote:

Quote:

>> This happens when you have a GPO applied to an OU that contains this
>> computer, and the GPO sets password policy. In other words, locally, no you
>> can't do anything as this is enforced using GPOs.
>>
>> If you are the domain admin, however, you can restructure your GPOs. One
>> option would be to create a new OU for computers that should not have this
>> policy. Then either make sure this GPO does not apply to that OU, or set a
>> new GPO that overrides this one.
>> ---
>> Your question may already be answered in Windows Vista Security:
>> http://www.amazon.com/gp/product/047...otectyourwi-20
>>
>>
>> "Noob" wrote:
>>

Quote:

>>> Ok, Simple question.
>>>
>>> I have a Local User Account created on a Vista Business computer. This
>>> Vista system is on our Domain. I need to have this local account NOT
>>> use the Domain password policies.
>>>
>>> I am NOT able to go in and edit or change these with the Local
>>> Security Policy (They are grayed out).
>>> I am using a Domain Admin account.
>>>
>>> How do I change this?
>>>
>>> All I really want to do is remove these for this local account
>>>

--
Paul Adare
MVP - Virtual Machines
http://www.identit.ca
The faulty interface lies between the chair and the keyboard.

permalink · 04-01-2008

hmm, I was afraid that was the case. I really only need to change the
local pol for the local account.

I can restructure our AD and remove the systems from that GPO i was
just wanting to find a quick way out. This is only for 3 systems that
need to have a local account with a set password due to a custom app.

Thanks for the info.

Was this the same with XP Pro?

03-31-2008	#1 (permalink)
Noob Guest n/a posts	Local Vista User Account using Domain Security Pol? Ok, Simple question. I have a Local User Account created on a Vista Business computer. This Vista system is on our Domain. I need to have this local account NOT use the Domain password policies. I am NOT able to go in and edit or change these with the Local Security Policy (They are grayed out). I am using a Domain Admin account. How do I change this? All I really want to do is remove these for this local account
My System Specs

04-01-2008	#2 (permalink)
Jesper Guest n/a posts	RE: Local Vista User Account using Domain Security Pol? This happens when you have a GPO applied to an OU that contains this computer, and the GPO sets password policy. In other words, locally, no you can't do anything as this is enforced using GPOs. If you are the domain admin, however, you can restructure your GPOs. One option would be to create a new OU for computers that should not have this policy. Then either make sure this GPO does not apply to that OU, or set a new GPO that overrides this one. --- Your question may already be answered in Windows Vista Security: http://www.amazon.com/gp/product/047...otectyourwi-20 "Noob" wrote: Quote: > Ok, Simple question. > > I have a Local User Account created on a Vista Business computer. This > Vista system is on our Domain. I need to have this local account NOT > use the Domain password policies. > > I am NOT able to go in and edit or change these with the Local > Security Policy (They are grayed out). > I am using a Domain Admin account. > > How do I change this? > > All I really want to do is remove these for this local account >
My System Specs

04-01-2008	#3 (permalink)
Hank Arnold (MVP) Guest n/a posts	Re: Local Vista User Account using Domain Security Pol? Correct me if I'm wrong, but I believe that there is only one password GPO for a domain. You can't have different ones for each OU... -- Regards, Hank Arnold Microsoft MVP Windows Server - Directory Services Jesper wrote: Quote: > This happens when you have a GPO applied to an OU that contains this > computer, and the GPO sets password policy. In other words, locally, no you > can't do anything as this is enforced using GPOs. > > If you are the domain admin, however, you can restructure your GPOs. One > option would be to create a new OU for computers that should not have this > policy. Then either make sure this GPO does not apply to that OU, or set a > new GPO that overrides this one. > --- > Your question may already be answered in Windows Vista Security: > http://www.amazon.com/gp/product/047...otectyourwi-20 > > > "Noob" wrote: > Quote: >> Ok, Simple question. >> >> I have a Local User Account created on a Vista Business computer. This >> Vista system is on our Domain. I need to have this local account NOT >> use the Domain password policies. >> >> I am NOT able to go in and edit or change these with the Local >> Security Policy (They are grayed out). >> I am using a Domain Admin account. >> >> How do I change this? >> >> All I really want to do is remove these for this local account >>
My System Specs

04-01-2008	#4 (permalink)
Paul Adare Guest n/a posts	Re: Local Vista User Account using Domain Security Pol? On Tue, 01 Apr 2008 04:22:32 -0400, Hank Arnold (MVP) wrote: Quote: > Correct me if I'm wrong, but I believe that there is only one password > GPO for a domain. You can't have different ones for each OU... Jesper is talking about GPOs that contain password policies that are linked some where other than at the domain level. Such GPOs will not affect domain accounts but will affect accounts in the local SAM of any computer which processes such GPOs. Quote: > > Jesper wrote: Quote: >> This happens when you have a GPO applied to an OU that contains this >> computer, and the GPO sets password policy. In other words, locally, no you >> can't do anything as this is enforced using GPOs. >> >> If you are the domain admin, however, you can restructure your GPOs. One >> option would be to create a new OU for computers that should not have this >> policy. Then either make sure this GPO does not apply to that OU, or set a >> new GPO that overrides this one. >> --- >> Your question may already be answered in Windows Vista Security: >> http://www.amazon.com/gp/product/047...otectyourwi-20 >> >> >> "Noob" wrote: >> Quote: >>> Ok, Simple question. >>> >>> I have a Local User Account created on a Vista Business computer. This >>> Vista system is on our Domain. I need to have this local account NOT >>> use the Domain password policies. >>> >>> I am NOT able to go in and edit or change these with the Local >>> Security Policy (They are grayed out). >>> I am using a Domain Admin account. >>> >>> How do I change this? >>> >>> All I really want to do is remove these for this local account >>> -- Paul Adare MVP - Virtual Machines http://www.identit.ca The faulty interface lies between the chair and the keyboard.
My System Specs

04-01-2008	#5 (permalink)
Noob Guest n/a posts	Re: Local Vista User Account using Domain Security Pol? hmm, I was afraid that was the case. I really only need to change the local pol for the local account. I can restructure our AD and remove the systems from that GPO i was just wanting to find a quick way out. This is only for 3 systems that need to have a local account with a set password due to a custom app. Thanks for the info. Was this the same with XP Pro?
My System Specs

Similar Threads
Thread	Forum
Domain account or local ?	VB Script
domain user account UAC without domain admin id/password??	Vista security
Failed to logon with domain user to Vista after copy local profile	Vista account administration
Transfering Settings from Domain Account to Local Account	Vista account administration
domain user can't be local administrator?	Vista General