Account Management - MCTS Guide to Microsoft Windows Server 2008 Active Directory Configuration - page 156

• User cannot change password —This option is useful when multiple users log on with the
same user account, a practice common with part-time employees or guests who need
access to the network. However, this option can't be set if “User must change password at
next logon” is already selected. If you attempt to set both options, Windows displays a
message stating that only one can be set.
• Password never expires —This option overrides the password policy that sets a maximum
password age to force users to change their passwords periodically. It applies only to pass-
word expiration, not to account expiration, and can't be set when “User must change
password at next logon” is already selected. Later in “Understanding Account Properties,”
you see how to set an expiration date for a user account.
• Account is disabled —This option, which prevents using the user account, is sometimes
used when user accounts are created before users require them, such as when you've hired
a new employee who hasn't started yet. You can also set this option on existing user
accounts when a user goes on extended leave or leaves the company, and the account will
be renamed and assigned to a replacement.
Activity 5-1: Creating User Accounts
Time Required: 15 minutes
Objective: Create user accounts with different account options.
Description: You want to experiment with some user account options that can be set during
account creation.
1. Log on to your server as Administrator, if necessary, and open Active Directory Users and
Computers.
2. Click to expand the domain node, click TestOU , and then click the New User toolbar
icon. ( Hint : Hover your mouse pointer over toolbar icons to see their descriptions.) Type
testuser3 in the User logon name text box. The User logon name (pre-Windows 2000) text
box is filled in automatically. However, the Next button is still disabled, which means you
haven't filled in all the required fields. Type Test in the First name text box and User3 in
the Last name text box. Now the Full name text box is filled in automatically, and the
Next button is enabled. Click Next .
3. In the Password text box, type p@$$word . Type p@$$word again in the Confirm password
text box.
4. Click to select the User cannot change password check box. Read the warning message, and
then click OK . Click to clear the User must change password at next logon check box, and then
click User cannot change password . Click Next , and then click Finish .
5. Read the error message. What can you do to change the password you typed in Step 4 so
that it meets complexity requirements? Click OK , and then click Back .
6. Type p@$$word1 in the Password and Confirm password text boxes. Adding a number at
the end meets complexity requirements, but you could also change one letter to uppercase,
such as p@$$Word. Click Next , and then click Finish .
7. Log off, and then log on as testuser3 with the password you just set.
8. Press Ctrl+Alt+Delete , and then click Change a password .
9. In the Old password text box, type p@$$word1 . In the New password text box, type
p@$$word2 , and type it again in the Confirm password text box. Click the arrow icon. You
get an “Access is denied” message because the account is prohibited from changing the pass-
word. Click OK , and then click Cancel . Click Log off .
10. Log on as Administrator, and open Active Directory Users and Computers.
11. Create a user in the TestOU OU with the logon name testuser4 and the first and last names
Test User4 . Enter an appropriate password, and then click Account is disabled . Click Next ,
and then click Finish .