Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

WINDOWS XP PRO


  • Please log in to reply
18 replies to this topic

#1 Kiwi1946

Kiwi1946

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:10:29 AM

Posted 02 July 2009 - 12:58 PM

This morning when I logged on a message popped up.

"Your password will expire in 14 days, do you want to change it now?"

Why do I have to change my password when logging on and is this password change done on a periodic basis.

I have only been using Windows XP Pro for a few weeks. I tried to find the setting for this but guess I'm looking in all the wrong places. :thumbsup:

Thank you.

BC AdBot (Login to Remove)

 


#2 fairjoeblue

fairjoeblue

  • Members
  • 1,594 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:09:29 AM

Posted 02 July 2009 - 01:35 PM

DO NOT change your password.
XP passwords DO NOT expire.
It sounds like an attempt to get you to change your password so your computer can be hijacked.

I suggest you run virus & malware scans.

I also suggest you post this here,

http://www.bleepingcomputer.com/forums/f/103/am-i-infected-what-do-i-do/
OCZ StealthXstream 700W,Gigabyte GA-EP45-UD3R , E8500, Arctic Freezer Pro 7, 3GB G.Skill PC8500,Gigabyte Radeon HD 4850 OC [1GB ], Seagate 250GB SATA II X2 in RAID 0, Samsung SATA DVD burner.

#3 Zllio

Zllio

  • Members
  • 1,107 posts
  • OFFLINE
  •  
  • Local time:10:29 AM

Posted 02 July 2009 - 01:38 PM

Hi KiWi1946,

I think what you mean is not that you wish to change the password, but that this particular setting is a problem.

Take a look at this:

http://www.kellys-korner-xp.com/win_xp_passwords.htm

Scroll down to the paragraph: Password Has Expired Message

These instructions do not quite fit my XP pro, for instance, you would not go Start / Programs / Administrative Tools, because in XP it would be Start / Control Panel / Administrative Tools. I think it is normal once you open the Administrative Tools. I didn't find the first option to be helpful. In the second instruction - this one: Start/Programs/Administrative Tools/Computer Management/Local Users and Groups/Right Click "User"(intended)/Properties I found when I finally got to the list of users and right-clicked on one of them and opened properties, on the General tab, there are three options, of which one of them is that the password never expires. Check that.

I don't know if you have to do the first option.


If you decide to try the fix they offer as the third option with the cmd prompt, I would make a back up of the registry first. To make a backup of the registry, please use the following instructions.

Please note: You are making changes to password settings. A wrong decision could lead to your not being able to get back into your computer. Make sure all your files are backed up before you try the third option. The second option should not be a problem, because you can reset it.


Backing up the Registry

Modifying the registry can be dangerous (and can render your system unbootable) so it's advisable that you make a backup of the registry before proceeding.
Modification of the registry can be EXTREMELY dangerous if you do not know exactly what you are doing so follow the steps that are listed below EXACTLY. if you cannot perform some of these steps or if you have ANY questions please ask BEFORE proceeding.

Backing Up Your Registry
  • Go Here and download ERUNT
    (ERUNT (Emergency Recovery Utility NT) is a free program that allows you to keep a complete backup of your registry and restore it when needed.)
  • Install ERUNT by following the prompts
    (use the default install settings but say no to the portion that asks you to add ERUNT to the start-up folder, if you like you can enable this option later)
  • Start ERUNT
    (either by double clicking on the desktop icon or choosing to start the program at the end of the setup)
  • Choose a location for the backup
    (the default location is C:\WINDOWS\ERDNT which is acceptable).
  • Make sure that at least the first two check boxes are ticked
  • Press OK
  • Press YES to create the folder.



Let me know if this helped.
Zllio

Edited by Zllio, 02 July 2009 - 01:40 PM.


#4 Kiwi1946

Kiwi1946
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:10:29 AM

Posted 02 July 2009 - 01:47 PM

DO NOT change your password.
XP passwords DO NOT expire.
It sounds like an attempt to get you to change your password so your computer can be hijacked.

I suggest you run virus & malware scans.

I also suggest you post this here,

http://www.bleepingcomputer.com/forums/f/103/am-i-infected-what-do-i-do/



Thanks for the info. I will run my virus scans.

#5 fairjoeblue

fairjoeblue

  • Members
  • 1,594 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:09:29 AM

Posted 02 July 2009 - 01:52 PM

If it were me & I got a password is going to expire message I'd be figuring out how to set it so the password is permanant.

If i got anykind of message asking me if i want to CHANGE my password I would immediatly go offline & be doing some very through scans !

There is a big difference between it's going to expire & do you want to change it.
OCZ StealthXstream 700W,Gigabyte GA-EP45-UD3R , E8500, Arctic Freezer Pro 7, 3GB G.Skill PC8500,Gigabyte Radeon HD 4850 OC [1GB ], Seagate 250GB SATA II X2 in RAID 0, Samsung SATA DVD burner.

#6 Andrew

Andrew

    Bleepin' Night Watchman


  • Moderator
  • 8,260 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Right behind you
  • Local time:07:29 AM

Posted 02 July 2009 - 02:35 PM

XP passwords CAN expire if they are set to do so.

Go to Start and click on Run... type in lusrmgr.msc and press Enter

This launches the Local Users and Groups management snap in. Double click on your account name and verify that the Password Never Expires box is checked.
Posted Image

Note: If your computer is joined to a local domain and you log on using a domain account then the password age restriction is set by the domain administrator and cannot be changed using the local users and groups tool. Speak to your domain admin in this case.

Edited by Amazing Andrew, 02 July 2009 - 02:36 PM.


#7 Kiwi1946

Kiwi1946
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:10:29 AM

Posted 02 July 2009 - 04:14 PM

XP passwords CAN expire if they are set to do so.

Go to Start and click on Run... type in lusrmgr.msc and press Enter

This launches the Local Users and Groups management snap in. Double click on your account name and verify that the Password Never Expires box is checked.
Posted Image

Note: If your computer is joined to a local domain and you log on using a domain account then the password age restriction is set by the domain administrator and cannot be changed using the local users and groups tool. Speak to your domain admin in this case.



I did the above as you wrote. The box Password Never Expires was checked. I don't know if this make any difference, the picture you enclosed shows the name in the upper left. Mine shows administrator. I neglected in my original post, the Windows XP Pro that I installed belongs to a friend. I had no problem activating it. Could I be looking at a problem here?????

#8 Kiwi1946

Kiwi1946
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:10:29 AM

Posted 02 July 2009 - 04:18 PM

If it were me & I got a password is going to expire message I'd be figuring out how to set it so the password is permanant.

If i got anykind of message asking me if i want to CHANGE my password I would immediatly go offline & be doing some very through scans !

There is a big difference between it's going to expire & do you want to change it.



Yes, when it comes to passwords I am leary. I ran a spyware program and now I will run my antivirus. Have to do this between thunder storms. :thumbsup:

#9 Andrew

Andrew

    Bleepin' Night Watchman


  • Moderator
  • 8,260 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Right behind you
  • Local time:07:29 AM

Posted 02 July 2009 - 04:20 PM

I don't know if this make any difference, the picture you enclosed shows the name in the upper left. Mine shows administrator.

Nope, no difference at all.

#10 Kiwi1946

Kiwi1946
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:10:29 AM

Posted 02 July 2009 - 04:24 PM

Hi KiWi1946,

I think what you mean is not that you wish to change the password, but that this particular setting is a problem.

Take a look at this:

http://www.kellys-korner-xp.com/win_xp_passwords.htm

Scroll down to the paragraph: Password Has Expired Message

These instructions do not quite fit my XP pro, for instance, you would not go Start / Programs / Administrative Tools, because in XP it would be Start / Control Panel / Administrative Tools. I think it is normal once you open the Administrative Tools. I didn't find the first option to be helpful. In the second instruction - this one: Start/Programs/Administrative Tools/Computer Management/Local Users and Groups/Right Click "User"(intended)/Properties I found when I finally got to the list of users and right-clicked on one of them and opened properties, on the General tab, there are three options, of which one of them is that the password never expires. Check that.

I don't know if you have to do the first option.


If you decide to try the fix they offer as the third option with the cmd prompt, I would make a back up of the registry first. To make a backup of the registry, please use the following instructions.

Please note: You are making changes to password settings. A wrong decision could lead to your not being able to get back into your computer. Make sure all your files are backed up before you try the third option. The second option should not be a problem, because you can reset it.


Backing up the Registry

Modifying the registry can be dangerous (and can render your system unbootable) so it's advisable that you make a backup of the registry before proceeding.
Modification of the registry can be EXTREMELY dangerous if you do not know exactly what you are doing so follow the steps that are listed below EXACTLY. if you cannot perform some of these steps or if you have ANY questions please ask BEFORE proceeding.

Backing Up Your Registry
  • Go Here and download ERUNT
    (ERUNT (Emergency Recovery Utility NT) is a free program that allows you to keep a complete backup of your registry and restore it when needed.)
  • Install ERUNT by following the prompts
    (use the default install settings but say no to the portion that asks you to add ERUNT to the start-up folder, if you like you can enable this option later)
  • Start ERUNT
    (either by double clicking on the desktop icon or choosing to start the program at the end of the setup)
  • Choose a location for the backup
    (the default location is C:\WINDOWS\ERDNT which is acceptable).
  • Make sure that at least the first two check boxes are ticked
  • Press OK
  • Press YES to create the folder.



Let me know if this helped.
Zllio




Thanks for the info and the link, Zllio

#11 case.bolt

case.bolt

  • Members
  • 190 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:29 AM

Posted 02 July 2009 - 11:04 PM

If it were me & I got a password is going to expire message I'd be figuring out how to set it so the password is permanant.

If i got anykind of message asking me if i want to CHANGE my password I would immediatly go offline & be doing some very through scans !

There is a big difference between it's going to expire & do you want to change it.


setting passwords to expire to force users to set new passwords periodically is a VERY common practice on the enterprise level. This forces people to re-secure their computers with a new, strong password every how-ever-many-days to minimize the chance of social engineering attacks succeeding.

Since this is an XP Pro installation, it has all the features of XP used on the Enterprise level. It's a very easy setting to overlook but can be inadvertently changed sometimes.

#12 Zllio

Zllio

  • Members
  • 1,107 posts
  • OFFLINE
  •  
  • Local time:10:29 AM

Posted 03 July 2009 - 01:15 AM

Kiwi1946,

I also found this and it may be relevant if your computer has an age-limit set in it:

http://www.pcmag.com/article2/0,2817,1203115,00.asp

***********

If it were me & I got a password is going to expire message I'd be figuring out how to set it so the password is permanant.

If i got anykind of message asking me if i want to CHANGE my password I would immediatly go offline & be doing some very through scans !

There is a big difference between it's going to expire & do you want to change it.


Hi fairjoeblue,

Thanks very much!

Well this has all gotten me thinking. Does anyone know what the actual legitimate message is that Windows throws up to indicate the password will expire? If it's true that that message doesn't ask you to change the password, then you are right that this would be a good way to spot malware.

***********

Also, here's a nice short pathway to the settings which is almost as good as Amazing Andrew's:

Right click My Computer, Manage, Local Users & Groups, Users, and right click on your account. Check "Password never expires".



Zllio

#13 case.bolt

case.bolt

  • Members
  • 190 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:29 AM

Posted 03 July 2009 - 01:44 AM

I go through these changes in XP roughly every three months (or every quarter as I work at a University :thumbsup: ) and the text of the message is normally:

Your password is set to expire in XX number of days. Would you like to change your password now?

yes button no button

I just changed my password a couple weeks ago...

#14 Zllio

Zllio

  • Members
  • 1,107 posts
  • OFFLINE
  •  
  • Local time:10:29 AM

Posted 03 July 2009 - 01:54 AM

ah, that's great!
I just found one that's similar.

https://commons.era.nih.gov/commons-help/167.htm

For security purposes, user passwords expire and must be reset. If your password is about to expire, a "password close to expiration" message is generated when you log in.

When your password expires, you are directed to select a new password. When you change your password, you do not need to notify anyone.


So if Kiwi's password is already set not to expire, then I wonder if it could be the age limit setting?

Zllio

#15 case.bolt

case.bolt

  • Members
  • 190 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:29 AM

Posted 03 July 2009 - 02:01 AM

I have my doubts as to whether this age limit setting in the Registry is the culprit. Case in point, my password on my home machine is set to never expire through the password manager, however, my registry setting says my maximum password age is 42 days. I have not changed the password on my home computer since I built it, about 1 1/2 years ago. I believe the registry setting only matters if your password is set to expire, then it will expire at the end of the number of days you set as max pass age. IF pass is not set to expire, that registry setting never comes into play.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users