Blog Post

Core Infrastructure and Security Blog
5 MIN READ

Secure Channel/Expired Machine Account Password Concerns – Revisited

MichaelHildebrand's avatar
MichaelHildebrand
Icon for Microsoft rankMicrosoft
Apr 23, 2020
Greetings! – I hope you and yours are as safe and as healthy as possible.    Due to the huge up-tick in remote workers, there has been a surge in questions/concerns around ‘stale’ device password...
Updated Apr 24, 2020
Version 5.0
chunlin xu
justin turner
Michael Hildebrand
Ned Pyle
ryan ries
Andy Helsby's avatar
Andy Helsby
Brass Contributor
Oct 30, 2020

DanielNiccoli , you can't change your password *locally* whilst not connected to a DC, however you can change your password on the Domain whilst not connected to a DC by changing your password in OWA, Self Service Password Reset (with password writeback enabled), RDS sessions all while your local laptop is not connected to the office network.

This then ends up with a situation where your offline machine has the old password and is quite happy, but your domain has a new password.

With a ton of people working from home using Office365 as their main data source for everything, this is a very real possibility and can even end up in situations where the domain account is locked due to expiry BUT the local machine is still obliviously working away with the old password. As long as that local machine does not need to vpn, rdp or otherwise access local resources, "everything is fine"