How can I disable account lockout policy for one user in a Windows domain

Question

My company is running a Windows based domain. The domain has a group policy of locking out a user after several failed log-in attempts, for 5 minutes.

Unfortunately, this account functions as a service account, and when the account locks out, a major service (Microsoft Team Foundation Server) ceases to function for those 5 minutes.

According to my IT manager, it is technically impossible, to remove the restriction for just one user account, though I suspect that his unwillingness (which I understand) to break policy is the real issue.

Could you please tell me if, and how to make an exception to the account policy? It seems to me unlikely that it is technically impossible to create exceptions to rules.

Disclaimer: I'm aware that having a service account that can log on to the system is a bad idea, but I unfortunately inherited this decision, and reversing it will take time.

Solution 1

As MichelZ, says, your manager is correct if you're on a 2003 domain. Though, regardless of that, I ideally wouldn't want to alter my policy for one single account, either. The real issue is that the service is attempting to log on with an incorrect password.

I'm posting this as an answer because the solution is to stop the issue altogether and figure out why a service is attempting to log in with the wrong password. If it's due to the password expiring then this can be sorted in AD Users and Computers rather than by reconfiguring the password policy:

This is standard practice for service accounts

Solution 2

The real solution is a "Managed service account", when you use the regular accounts or even fine grained passwords and you set it to 'never expire' It's a security leak, with a managed service account the computer is changing the password itself and you don't have to keep track on it. and it's very secure!

Here's a link http://technet.microsoft.com/en-us/library/dd548356.aspx

Solution 3

This is true for Windows Domains below 2008. Since Windows 2008, you can have different policies.

Have a look here: http://www.windowsecurity.com/articles/configuring-granular-password-settings-windows-server-2008-part-1.html

Edit:

Here's a link from Microsoft: http://technet.microsoft.com/en-us/library/cc770842(WS.10).aspx

Comments

[Assaf Stone]

I know I have to resolve the "bigger" issue. First things first, I have to make sure that the system is running and not freezing up and stopping 150 developers from working for 5 minutes (at a time).

[Dan]

@AssafStone I know what it's like to diagnose under pressure, but you need to remember that big sweeping policy (Both technical and procedural) changes are definitely never the first step. I know people like to push the business critical angle, but making hacky changes all the time nearly always leads to more issues and longer downtime in the long term. And those hacks never get put right, no matter the intentions of those doing them! But glad I could help, though.

[Assaf Stone]

Hmmph. Unfortunately it turns out that our domain is 2003. Looks like the IT guy was right for a change...

[Assaf Stone]

Unfortunately the Managed Service Account doesn't help me with a 2003 server.

[solefald]

There are legitimate use cases for disabling lock out on a single account. A significant amount of releases and migrations are not thoroughly tested. And when everyone goes home for the weekend and all hell breaks loose, people watching your network may not be able to get hold of responsible parties until Monday, and they have 2 choices - every 15 minutes keep unlocking this obscure account that no one knows about, because it belongs to a legacy application component that everyone forgot even existed, or disable password lock out until the development gets a chance to take a look at it.