DSfW: Password Restriction Joining a workstation to a DSFW domain

  • 7005568
  • 30-Mar-2010
  • 22-Aug-2014


Novell Open Enterprise Server 11 SP2 (OES11 SP2) Linux
Novell Open Enterprise Server 11 SP1 (OES11 SP1) Linux
Novell Open Enterprise Server 2 SP2 (OES11 SP2) Linux
Domain Services for Windows


Upgraded DSFW from OES2SP1 to OES2SP2

Try to join a workstation to the domain after the upgrade

/var/log/messages shows the following when joining a workstation to the domain:

Mar 3 17:35:22 delta xadsd: [NETLOGON] Setting account password for object
Mar 3 17:35:22 delta xadsd: [NETLOGON] Setting account password failed:
Password Restriction


The machine password is unable to be set.
Verify the Default Password Policy is assigned to the Computers container.
The nspmPasswordPolicyDN attribute is missing from the Computers container.  This attribute should be on the computers container and the Default Password Policy.Policies.System.<domain> should show as the value.
Add this attribute and populate it with the Default Password Policy object.  The Domain Contollers container should also have this assigment.

Additional Information

All containers with computers (objectclass=mSDS:Computer) must use this password policy or a password policy with the same settings.  If computers are moved to or joined into a different container, the container should contain only computers, no users.  If GPOs are used with containers holding computer objects for the password policy, be sure the password policy is similar to the Default Password Policy located in the cn=Password Policies,cn=System,<domain> TID 7004481

If the Default Password Policy is missing, follow TID 7015573 to re-create the password policy.