Domain controller: Refuse machine account password changes
Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2
Domain controller: Refuse machine account password changes
Description
This security setting determines whether domain controllers will refuse requests from member computers to change computer account passwords. By default, member computers change their computer account passwords every 30 days. If enabled, the domain controller will refuse computer account password change requests.
If it is enabled, this setting does not allow a domain controller to accept any changes to a computer account's password.
Default: Disabled.
Configuring this security setting
You can configure this security setting by opening the appropriate policy and expanding the console tree as such: Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\
For specific instructions about how to configure security policy settings, see Edit security settings on a Group Policy object.
For more information, see: