Your information regarding the passprop utility is incorrect.

It DOES NOT set the account lockout policy for the administrator so "The Administrator account will be subject to the same lockout policy as all other accounts are."

It DOES allow the administrator account to be locked out of accessing the system from the network.

When performing an interactive login on a local system with the local administrator account, the administrator account WILL BE ABLE TO LOGIN REGARDLESS OF THE LOCKED STATE OF THE ID.

Passprop.exe DOES NOT keep a locked administrator account out of a system entirely.

According to the documention, the exception is the interactive login to the domain controller with the domain administrator account.

According to real world testing with SP6a and NT 4.0 workstation, the REAL exception as follows:

Interactive login to the local system with the local system administrator account.

James Nelson 3/7/2001 12:38:47 PM

Provided you're following the recommendation I made in the article not to use the Administrator account for day-to-day administration, I suggest that you secure the account with a strong password and keep the password locked away. Setting up password expiration isn't necessary unless you're worried that someone will guess the password over time. Monitoring logon activity for the account can mitigate that risk.



--­Randy Franklin Smith

Randy Franklin Smith 8/2/2000 3:06:22 PM

I read R. Franklin Smith's "Protect Administrator Privileges" (February 2000), and I want to know whether the author recommends using passwords that expire on the built-in Administrator account. If so, does this configuration present any challenges?

Ingrid Beierly 8/2/2000 3:05:56 PM

I’ve been a Windows NT administrator for 2 years and a few months, and I’m still learning about NT. Recently, our corporate headquarters contracted some security specialists to investigate our security setup. I can’t believe how much they uncovered in 60 minutes!
I read R. Franklin Smith’s “Protect Administrator Privileges” (February 2000), which provided valuable in sight into NT security. I’ve immediately be gun enforcing some of the author’s suggestions. Have you published any other security articles that I might find interesting and useful?

Wayne Sutton 6/7/2000 11:29:42 AM

Security is one of the core topics that the magazine covers every month. The easiest way to find other articles is to browse the magazine’s article archive at http://www.win2000mag.com; you can search by topic, issue, author, or keywords. Another good online resource for in-depth security information is the NTSecurity.net Web site at http://www .ntsecurity.net.

Randy Franklin Smith 6/7/2000 11:29:42 AM

This may not be major, but it's worth noting that User Manager will not permit enough characters in the description field of the decoy administrator account to completely mimic the description. One or two characters have to be omitted, and can be detected. Isn't that odd ?

Bruce Bramkamp 5/25/2000 7:05:22 AM

Very good, thought provoking article. I wish you went into more depth regarding Exchange security issues.

Jon Brown 5/24/2000 9:37:12 PM