about how the ad domain can also use the old password to log on correctly after password modification with LDAP authentication logon problem Resolution

Recently has been doing an LDAP management authentication login platform, but found in Active Directory to modify the user account password, LDAP authentication can also be certified, and log into the system, what is the reason?

After reviewing the relevant data, it is found that the cause of Active Directory is, so how to solve this problem can be solved by modifying the life cycle time of the old password;

Specific reasons:

After a domain user successfully changed the password using NTLM, the old password is still available for the network access user-definable time period. This behavior allows accounts, such as service accounts, to log on to multiple computers to access the network, while password changes are propagated.

? The extended lifetime of the password is only available for network access using NTLM. The interactive logon behavior remains the same. This behavior does not apply to clients that are hosted on stand-alone servers or member servers. Only domain users are affected by this behavior.

? The life cycle time of the old password can be configured by editing the registry on the domain controller. This registry change will not take effect until you restart the computer.

Workaround:

To change the life cycle time of the old password, add the DWORD entry named Oldpasswordallowedperiod to the following registry subkey on the domain controller:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

To do this, follow these steps:

1) Click Start, click Run, type regedit, and then click OK

2) Locate and click the following registry subkey:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

3) On the Edit menu, point to New, and then click DWORD Value.

With the same name as the DWORD value, type Oldpasswordallowedperiod, and then press ENTER.

Oldpasswordallowedperiod Right-click, and then click Modify, in the Value data box, type the desired value in minutes, and then click OK to complete the modification;

Precautions:

After modifying the corresponding life cycle time, this means that you can not access any information, under normal circumstances we do not recommend such a modification;

about how the ad domain can also use the old password to log on correctly after password modification with LDAP authentication logon problem Resolution