This security setting determines how often a domain member will attempt to change its computer account password. Default: 30 days. By default, domain members automatically change their domain passwords every 30 days. If you increase this interval significantly or set it to 0 so that the computers no longer change their passwords, an attacker would have more time to undertake a brute force attack against one of the computer accounts. Important This setting applies to Windows 2000 computers, but it is not available through the Security Configuration Manager tools on these computers. Counter Measure: Configure the Domain member: Maximum machine account password age setting to 30 days. Potential Impact: None. This is the default configuration. Fix: (1) GPO: Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\Domain member: Maximum machine account password age (2) REG: ### (3) WMI: ###