User account security policy setting

[Wendy_9]

Hi all,

I have changed two security policy for the system.

Maximum Password Length : 8 to 20
Lock Inactive Accounts : Disable to 60 days

After enabled the Lock Inactive Accounts on the system, some accounts were disabled. The reason of deactivated the accounts is "inactive too long." But, I have checked the last successful password change time of one account was Jan 29, that is within 60 days. The others last successful change time are also within 60 days too.

Is the change of password won't reset the inactive time?

Also, the system is a trusted system. The user account will be deactivated when type the password wrong for 3 times. But after enabled the above settings, reset the above inactive account at SAM. The user account has locked after type the password wrong for 1 time.

Can anyone know the reason why??

Thanks

Regards,
Wendy

[Rajeev Shukla]

See there are 2 types of security policies one is system wide and other is user level. So if you have made system wide change and 60 days but check for those 2 users they might have their own security settings for less than 60 days inactive account and just 1 attempt to disable account.
So in nut shell user security setting over ride the system wide policy.

Rajeev