4

What is the "lifespan" for a login with the option Enforce Password Expiration Enabled?

Where can I find configuration/option to change the time?

  • This comes from Windows. You can't change the expiration time for a specific password, IIRC. – Aaron Bertrand Dec 23 '14 at 19:06
  • I can know what is the time? – Diego Flores Dec 23 '14 at 19:14
  • The answers below show that - maximum password age. You'd have to know when the password is set to know when it will expire. Why don't you just change the password, then the expiration won't matter (for now)? – Aaron Bertrand Dec 23 '14 at 19:18
5

Per the following article, This information can be found in:

Start -> All Programs -> Local Security Policy

Then navigate to Account Policies -> Password policy

You should see something similar to this:

enter image description here

http://www.mssqltips.com/sqlservertip/1088/sql-server-login-properties-to-enforce-password-policies-and-expiration/

  • 4
    Additional note: This policy is maintained/enforced at the domain level (via Domain Group Policy) if the machine is a member server. You cannot modify these settings at the local server if it is part of a domain. – Shawn Melton Dec 23 '14 at 19:08
  • @ShawnMelton - spot on and a very good point. – Kris Gruttemeyer Dec 23 '14 at 19:09
4

This isn't an answer to the actual question asked, but commentary too long for a comment.

FWIW I don't create SQL Auth logins that obey Windows password policies. I can avoid that simply with:

CREATE LOGIN foo WITH PASSWORD = N'bar', CHECK_POLICY = OFF;

If I want logins to use Windows-based password policies, I'll make users log in with Windows authentication. Then I get the benefit of their password complexity and expiration for free, without having to create additional accounts that also must be maintained.

For applications, I fail to see the benefit of enforcing a lifetime for passwords. If you have a personnel change, then change the password manually (unless you can predict when you will have personnel changes). If you change this based on some arbitrary window, you're just creating extra maintenance for little to no gain, IMHO. If people have access to the connection string, they have access to it before you change the password, and after, too.

3

The lifespan of a login with Enforce Password Expiration enabled is set by Windows. I understand that in a Domain, the property is set at the domain level then propogated to the Windows account.

I do not believe that you can directly change it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.