domain group policy has pushed down "passwords must meet conplexity
rules"
Now PC is a standalone, no network connection.

How do I reset this policy..aka get rid of it?  or put another way
How do I find this value in the registry and change it back to
disabled instead of enabled.

If i have to use SECEDIT, where do i get a fresh system.adm?

---

Request for Question Clarification by missy-ga on 27 May 2003 14:20 PDT

Hi there,

What OS are you using?

--Missy

---

Clarification of Question by dadiehl-ga on 28 May 2003 08:45 PDT

see w2k - admin tools-local security settings-account
policies-password policy.
now you'll see two columns, the local setting and the effective
setting.  If the effective settig is different from the local setting,
it means a domain policy changed it.  How do you set it back to the
local setting, the setting you want?



Using windows 2000 server on a windows 2000pc.  Assuming active
directory is deploying group policies

Only thing I can come up with is:
1.  creating my own passflt.dll and applying it to my pc (we actually
use scecli.dll?)  this is a password filter that microsoft gives you
to enhance complexity rules.. but it lies on the server so if you can
never connect to the domain, will a local passflt.dll work?

2.  get a generic fresh system.adm (security template) and try to
override the domain settings by applying another system.adm using
secedit

3. after i posted this question, i found group policy extentions in 
hklm\software\microsoft\windows nt\currentversion\winlogon.  These
look like the actual policies being pushed down.. Can I simply delete
these hives/keys and have the domain policies be disarmed?

If the computer is in fact no longer set up as a member of a domain, I
believe you should be able to change the local setting to "disabled,"
and then log off / back on (and possibly restart) to have the setting
saved.

But first, you need to properly make sure that this PC is no longer
set up for using a domain. To do this, right-click "My Computer,"
choose "properties," then the "Network Identification" tab. There are
two ways of doing this:

1) Click the "properties" button and make sure that "workgroup" is
selected and a workgroup name is specified instead of a domain. Click
OK, and restart if needed.

2) Use the "Network ID" button to open the "Network Identification
Wizard."
Click next and if you are not on a network (i assume this is so,
because you said its a standalone pc), you will want to choose "this
computer is for home use and is not part of a business network." Then
click "next" and "users must enter user name and password..." then
next and finish.

However, if you have a local network, you will probably want to choose
"This computer is part of a business network..." Hit next, and on the
next dialog, make sure you choose "my company uses a network WITHOUT a
domain." Click next, enter a workgroup name and then next and finish.
Restart if asked.

Once you restart, the PC should be set up as a standalone workstation
and no domain policies should be enforced and you should be able to
change the password policy, among other things. You will probably
still need to restart in order for some of those settings to take
effect.