The PWDLastSet attribute is controlled by the system. You cannot set this with two exceptions, you can set 0 and you can set -1. In order to achieve your requirements of different password expirations, you have essentially 2 options, FGPP and a separate domain. An option which isn’t so elegant is to write a script which presents an annoying pop-up window every time they log on but it will do little to enforce this. A better option is to upgrade to Windows 2008 R2 or greater on the domain controllers. Start now and go quickly, you have about one year left of extended support before 2003 goes end of life.
↧