WinSecWiki > Security Settings > Local Policies > Security Options > Domain Member > Maximum machine account password age
Domain Member: Maximum machine account password age
Each member computer has a computer account in the domain guarded by a password. When a member computer needs to communicate with the domain controller for certain security operations like NTLM authentication and account lookups by SID, the computer establishes a “secure channel” to the domain controller with its computer account password as the basis.
Windows computers periodically change account password similar to an end user. NT computers change their password every 7 days. Windows 2000 and later computers change it every 30 days by default but with this setting you can specify a different interval.
Bottom line
There’s no reason to configure this setting unless you need to lengthen the password change interval to reduce domain controller replication load.
Back to top