Home / server / Questions / 791422
Accepted
jffalmeida
Asked: 2016-07-23 06:13:26 +0800 CST

Windows Server 2008 R2 functional level - DSQUERY

  • 772

After executing some queries (dsquery computer domainroot -stalepwd), using dsquery, I was told this command connects to the available DC and for this reason the results might be untruthful because the DC's do not replicate computer accounts password.

After some research I wasn’t able to understand if this true or not, meaning: When I'm using the command "dsquery computer domainroot -stalepwd" would the result take into account all the DC's information or the one I’m connecting to by default?

Thanks in advance!

JFA

domain-controller dsquery

1 Answers

  1. Best Answer

    The command is accurate because it will search for computers whose password has not changed in the number of days that you specify. (By default, computers change their own passwords every 30 days as long as they're connected to the domain.)

    Source

    This information is replicated amongst domain controllers, in the pwdLastSet attribute, so assuming replication is healthy, it will be consistent throughout the domain. You will get the same answer no matter which DC you query.

    According to MS-ADTS, pwdLastSet is urgently replicated.

    • 3