samba and nt, nt box vs. pdc change machine passwords ?

[Makis Marmaridis]

Actually, this is not quite accurate. The machine accounts on an NT domain
are changed automatically on a weekly basis. Therefore, it doesn't matter
how much you wait until you do the imaging, you are still bound to run into
the same problem.

Microsoft suggests the following work-around

http://support.microsoft.com/support/kb/articles/Q154/5/01.ASP

that basically says that by modifying a particular registry key, you can
stop this behaviour (which also means that other people might then be able
to easier impersonate one of your trusted machines on the domain by guessing
its password (however until today I haven't heard of anybody doing so...
yet!) :-)

HTH,

Cheers,
Makis.


-----Original Message-----
From: samba-ntdom-admin at us5.samba.org
[mailto:samba-ntdom-admin at us5.samba.org]On Behalf Of Doug Breshears
Sent: Tuesday, 16 January 2001 3:28 PM
To: Jens Schwepe; samba nt domain mailinglist (E-Mail)
Subject: Re: samba and nt, nt box vs. pdc change machine passwords ?


I believe that the machine accounts get changed after a
period of being
on the network. You might do well to install and wait a week
or two, then
image the HD, this I believe would give you the stable
machine SID. I am
not sure of this completely accurate just my 2 cents.
Doug.

----- Original Message -----
From: Jens Schwepe <js at ic-bremen.de>
To: samba nt domain mailinglist (E-Mail)
<samba-ntdom at us5.samba.org>
Sent: Monday, January 15, 2001 8:54 AM
Subject: samba and nt, nt box vs. pdc change machine
passwords ?


> hi,
>
> i've successively set up a network with 10 nt boxes and 2
samba servers.
> first is file server, second is pdc and login server with
the
> machine/user passwords file.
>
> to minimize admin work i've made a snapshot of every
client's hard disk
> partition with ( dd if=/dev/hda1 | gzip -c --best >
client.disk.gz ) to
> the file-server, which is read back to the client's disk
every night.
> Thus feigning the nt boxes would be freshly installed
every morning :-)
>
> cool thing i guess, but every now and then one or more of
the
> server-side stored machine passwords seem to change,
resulting in users
> not able to login on that particular machine anymore ( -->
nt box says
> something like "machine not member of domain").
>
> could it be that during normal login/logoff work the nt
boxes and the
> pdc internally change/modify the machine's password ???
>
>
> thnx in advance
>
> Jens Schwepe
> js at ic-bremen.de
> www.ic-bremen.de
>
>
>
>