samba - Jun 2010 - issues with pam_winbind and ability to use old windows password

I'm currently using an implementation of pam_winbind to authenticate users
on linux servers via Active Directory. This works as expected apart from an
issue whereby after changing a password, a user can login with both their old
and their new password.

Having done a bit of investigation, it appears that this is a 'feature'
from Microsoft as described in http://support.microsoft.com/kb/906305/en-us and
http://community.ca.com/blogs/securityadvisor/archive/2007/12/11/microsoft-ntlm-authentication-behavior-allows-using-of-old-passwords.aspx

The systems that currently use pam_winbind are a combination of RHEL 4/5 and
SLES 10/11 servers with the samba packages that are released with the distro.

If anyone is aware of a way to address the issue without having to modify
anything on the windows domain controller, it would be greatly appreciated.

Thanks,
Matt Delves
-- 

---------------------------------------------
Matthew Delves
System Administrator
Information Systems
Networks & Infrastructure
University of Ballarat
ph: 03 5327 9732
email: m.delves at ballarat.edu.au