This security setting determines how often a domain member will attempt to change its computer account password. Default: 30 days. By default, domain members automatically change their domain passwords every 30 days. If you increase this interval significantly or set it to 0 so that the computers no longer change their passwords, an attacker would have more time to undertake a brute force attack against one of the computer accounts. Important This setting applies to Windows 2000 computers, but it is not available through the Security Configuration Manager tools on these computers. Countermeasure: Configure the Domain member: Maximum machine account password age setting to 30 days. Potential Impact: None. This is the default configuration. Fix: (1) GPO: Computer ConfigurationWindows SettingsSecurity SettingsLocal PoliciesSecurity OptionsDomain member: Maximum machine account password age (2) REG: ### (3) WMI: ###

[30/90]

(1) GPO: Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\Domain member: Maximum machine account password age (2) REG: ### (3) WMI: ###