I'm writing a script to audit/apply security settings on NT 4.0 and Windows 2000 servers. NT 4.0 is very straightforeward (registry settings, API calls) for everything, but Windows 2000 introduces the security database to store some security settings. I'm trying to limit the number of system calls I make to pull/set the information, and I want to cut out using secedit altogether.

My problem is this: Complex Passwords are set in the security database. 'Net Accounts' will not pull this information, and Win32::Lanman seems to be dry here as well (though for a while I though NetUserModalsGet had hope). In NT 4.0, password filtering is handled by a .dll in the registry, but not in 2000.

Anyone know of a OLE method of pulling information from the security database? I'm already OLE'ing for IIS information, so that's no biggie to tack on more. If no OLE, any progress elsewhere?

Right now, to get complex password settings, I do this:

$result = `secedit \/EXPORT \/DB C:\\Winnt\\Security\\Database\\secedi
+t.sdb \/CFG security.txt`;
open(SECURITY, "security.txt");
@lines = <SECURITY>;
foreach $line (@lines) {
if ($line =~ /PasswordComplexity = (\d+)/){
$passFilt = $1;
}
}
[download]

Confangled, and I'm going around my elbow to get to my nose, but it works. Any help???

Josh Pavel