old password usable after a password change

[ADAMEE]

Hi,

Good day to all. I have an ADAM synchronising its proxy-user from an AD.

After changing password in an XP client logon to the AD(restart or without restart), both the old and new passwords can still be used to LDP into the ADAM.

1. Though there are many DCs in my AD, replication is ruled out - as the phenomenon remains after a force replication on all the DCs.

2. AD-ADAM sync is also ruled out as I after performing a manual synchronisation (via the XML stuffs), the symtom persists. In addition, it is a proxy-user, so authentication is refered to the AD DCs, right ?

3. On my XP client, I had also renew the kerberos tickets via "klist.exe purge" and "klist.exe tgt"

I had come across a MS NTLM behaviour issue, something to do with "OldPasswordAllowedPeriod" - http://support.microsoft.com/kb/906305

I would like to know do I need to know if I need to change this setting on an AD-DC ?

Do I need to do anything more on the ADAM configuration sets or anything at all ?

I would appreciate if anyone has come across this provide some advice to me. Thanks.

Have a nice day.

[Connect_Me]

Try this back again it might help you. Navigate to Control Panel and open Administrative Tools. Open the 'Users and Groups in Active Directory. Right click on the root domain container and select Properties. . In the Properties dialog, click Group Policy tab. Then click New to create a new Group Policy object (GPO) in the root container. Specify the name of the new directive and group and then click Close. Right click on the root domain container and select Properties. This shows again the Domain Properties dialog. Click the Group Policy tab, and select the link for the new Group Policy Object you just created. Click Up to move the new GPO to the top of the list, and then click Edit to open the Object Editor Group Policy. Expand the Computer Configuration node and navigate to the folder Windows Settings Security Settings}}} Account Policies Password Policy. The right pane, double-click on the `Enforce password history. Then select the 'Define this policy setting' and set the 'Save password history' to 24. Click the OK button to close the dialog.