不使用计算机账户,长期未开机的计算机不能用域账号登录的原因

在工作中经常会遇到域内计算机长期未开机，过一段时间后不能使用域账号登录的问题。经查找文档，现在终于搞清楚了其中的原因。

Microsoft KB    http://support.microsoft.com/kb/154501/en-us

域内的用户账号和计算机账号

用户账号

我们知道域内默认域策略要求最长用户密码使用时间是42天，42天内必须更改密码，否则密码过期，用户使用域账号和密码登录就会失败。

计算机账号

同样针对计算机账号，为了安全原因，Microsoft也设定了计算机账号过期时间。

NT-based 计算机默认计算机账号过期时间7天

win2000-based 计算机默认计算机账号过期时间30天

查看计算机账号过期时间设置

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters

MaximumPasswordAge 默认为30

那么设定计算机账号定期更换的意义在哪里呢，我们看Microsoft的解释

If you disable machine account password changes, there are security risks because the security channel is used for pass-through authentication. If someone discovers a password, he or she can potentially perform pass-through authentication to the domain controller.

翻译过来就是：

如果你禁用了计算机账号更改功能，就会有安全风险，因为计算机和域控制器之间是通过识别计算机账号密码来建立一个安全通道进行通信的。如果有人获知了计算机账号的密码，他就有潜在可能使用计算机账号、密码和域控制器之间建立安全通道从而获取或更改你域控制器上的数据。

禁用计算机账号密码更改

客户端更改，更改后计算机将不会再发起更改计算机账号密码的请求

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters

将DisablePasswordChange 键值改为1 保存

域控制器更改，更改后域控制器将会拒绝NT4.0以后客户端发起的计算机账号密码更改请求

Start Registry Editor. To do so, click Start, click Run, type regedit in the Open box, and then click OK.

Locate and then click the following registry subkey:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters

On the Edit menu, point to New, and then click DWORD Value.

Type RefusePasswordChange as the registry entry name, and then press ENTER.

On the Edit menu, click Modify.

In the Value data box, type a value of 1, and then click OK.

Quit Registry Editor.

后面还有些microsoft的文档，有兴趣可以了解下

Note The RefusePasswordChange registry entry causes the domain controller to refuse password change requests only from workstations or member servers that run Windows NT version 4.0 or later.

If you set the RefusePasswordChange registry entry to a value of 1, after the workstation or member server first tries to change its machine account password, future attempts to change the password are prevented (by returning a distinct status code). A Windows NT 4.0-based computer will try to change its machine account password again in seven days, and a Windows 2000-based computer will try again in 30 days. If you set the RefusePasswordChange registry entry to a value of 1, the replication traffic will stop, but not the client traffic. If you set the DisablePasswordChange registry entry to a value of 1, both client and replication traffic will stop.

这里就有趣了，microsoft说如果你禁用了计算机账号密码更改，那么你可以在同一台电脑上安装两个以上的windowsNT或是windows2000操作系统(我估计2000以后的windows版本也可以,这篇kb是2000时代的)，并且这两个或多个操作系统可以使用相同的计算机账号。

If you disable automatic machine account password changes, you can set up two (or more) installations of Windows NT or Windows 2000 on the same computer that use the same machine account. To do so, follow these steps:Install Windows NT or Windows 2000, and set up the computer as a workgroup member.

Disable the automatic machine account password changes. To do so, set the DisablePasswordChange registry entry in the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters registry subkey to a value of 1.

Restart the computer.

Set up the machine account on the domain controller by using Server Manager on a Windows NT 4.0 domain controller, or by using Active Directory Users and Computers on a Windows 2000 domain controller.

Join the computer to the domain.

Perform a second installation of Windows NT or Windows 2000 in a separate directory, and set up the computer as a workgroup member.

Repeat steps 2 through 3.