Forum Discussion
Active directory allowing old and new password after reset
We are using windows 2019 server and once password is reset (before expired), we see a behavior that old password is valid for 5mins after password reset. Our replication delay is 15 seconds and we h...
Hi! The 5 minutes is expected for NTLM network access. Microsoft’s current KB says the old password default lifetime is 5 minutes if OldPasswordAllowedPeriod is not set. You can change it on the DC under HKLM\SYSTEM\CurrentControlSet\Control\Lsa, but remember it affects NTLM network access, not normal interactive Kerberos behavior.