You have an Active Directory domain named contoso.com.
You need to view the account lockout threshold and duration for the domain.
Which tool should you use?
A.
Computer Management
B.
Net Config
C.
Active Directory Users and Computers
D.
Gpresult
Explanation:
Same question as K/Q44.
Hard to find references for this one. I checked thesteps below on a virtual lab.
You can see the required settings when you:
1. Open Active Directory Users and Computers
2. Go to View in the menubar and make sure “AdvancedFeatures”is checked.
3. Right click on the domain and choose Properties
4. On the Attribute Editor tab click on Filter
5. Ensure that the Show attributes/Optional check box is selected.
6. In the Attributes list locate lockoutThresholdand lockoutDuration.
Played with the settings in the Group Policy Management Editor and the settings were reflected in the steps
above every time.
I set up a new domain in a new forest and followed the steps above. According to my default domain policy, account lockout threshold is 0 attempts and account lockout duration is not defined. When following the above steps, the attribute editor is indicating the lockout duration is 30 minutes.
Running the following command indicates password policies from the default domain policy:
gpresult /user Administrator /scope computer /v
When I run gpresult, I do not get the recommended settings for the lockout duration. Because the setting is not defined, it simply doesn’t show up in the list.
I then assigned a PSO to the Administrator account. I refreshed group policy just to be on the safe side and then ran gpresult again. Gpresult continues to reflect the values indicated in the default domain policy.
Given the very minor glitch where the attribute editor shows the wrong value if the policy is not defined, I would instead go with gpresult.
0
0