"Expire Password" setting

If you check the "Expire Password" setting under a user's "Account Control", Save and then open up the user info page again, this setting becomes unchecked. So simply opening up the page again causes the user not to be prompted for a new password, whereas that is what you expect to happen. Why does that option become unchecked automatically?

Spadafo:
No. I don't want the change to be optional, nor do I want to ask the administrator to do anything; I want to do it myself.
And I found the solution: Simply do it in 2 steps:
Change the password – “Apply Changes”, then go back into the user’s page - click "Expire Password" - “Apply Changes”
That way, the "Expire Password" will apply to the new password, not the old one, and thus the user WILL be prompted to change it.
I have to consider this a fault in APEX. If you've already entered a new password, then "Expire Password" SHOULD MEAN expire the new password. It doesn't make sense for it to mean expire the old password if you've just entered a new one.
After all, it is a pretty common scenario for the end user to forget the password, in which case you want a fast method of changing it and requiring it to be immediately changed from what you set it to. So you should be able to do this by entering the User's page only once.
Edited by: Prohan on Sep 30, 2009 7:14 AM

Similar Messages

Site Login Behavior For SharePoint Foundation 2013 Users With Expired Passwords?

What are the most user-friendly ways of getting external users with expired AD passwords back into the SharePoint site with a new working password?
We already send automated email notifications to users reminding them to change their soon-to-expire passwords. However, sometimes they miss seeing the email notifications before the password expires (such as after returning from vacation or just carelessness
and lack of attention to email messages) or they see the warning messages and forget to act on it.
When this happens and they try to log into the SharePoint site from the Internet, their login fails without telling the user the reason they can't log in is because their password expired. So, they end up confused and call the help desk to get their
password reset.
Is there a way to set up SharePoint Foundation 2013 login in a similar way to the OWA login so that, when a user with a correct but expired password tries to log in, it gives them a prompt to set a new password right there rather than just an error indicating
their login failed for unknown reasons or password is "incorrect?"

It could be done. You get a different event log entry for an expired login attempt than for a wrong password, 4625 events denote a login failure and an error ID of 23 denotes a logon failure.
A naff, but simple, approach would be to create a tool that checks your server logon event log for 4625 entries and then emails that user, or the help desk, or security, that they're trying to get onto your system with expired credentials.
For a more polished experience you've got a lot more work and bluntly it's going to be impractical for you. You'd have to re-write sections of the SharePoint authentication process or intercept the process, both are risky and not a good idea to try.
There's a really interesting paper here that might be of interest, it won't help you in your current situation but it might shed more light on the overall authentication/authorisation process.
http://www.sans.org/reading-room/whitepapers/forensics/windows-logon-forensics-34132

Which attribute shows if a user has an expired password?

DSEE 6.3
I created my own password policy, and applied it to a single user.
I would like to know which attribute shows if a user has an expired password, and how do I query that attribute for the user. How would I query the time till expiration as well?
I am basically looking for example queries to such information.
thanks,

My limited experience with this sort of thing is to run a query like the following:
ldapsearch -1TL -h `hostname` -D 'cn=Directory Manager' -b "dc=<your dc>,dc=com" uid=<uid your choice> pwdAccountLockedTime pwdFailureTime pwdLastAuthTim
e pwdChangedTime passwordRetryCount nscpentrywsi
This dumps some helpful stuff. I've noticed ... in our ldap instance that a locked account has the following output:
pwdAccountLockedTime: 000001010000Z
I don't know why it shows up that way ... but it's something I can key on and search for to find locked accounts. Not necessarily an indication that a password has expired, of course, but sort of interesting to me. An account can be locked for other reasons obviously.
I think pwdChangedTime might be what you want assuming you know what the password expiration time is set to ...

SSH / Expired Passwords

I've recently installed a batch of servers with Solaris 10 10/08 and have noticed that the way the Solaris sshd implementation deals with password change on login is different to previous versions of Solaris SSH and/or OpenSSH installed in out environment.
When the user with expired password logs in, he is prompted for a new password. If this password does not meet the complexity standards set for user passwords, the user is then prompted for their original password again instead of being asked to add a valid new password. This has led to a lot of users locking out their accounts because they keep trying to put in the new password
The session output looks like this
ssh -l user serverPassword: <-Enter Existing Password Here
Warning: Your password has expired, please change it now.
New Password: <-Enter new password that does not meet password standards
sshd-kbdint: The password must contain at least 1 uppercase alpha character(s).
Password: <- System requests exising password again
Warning: Your password has expired, please change it now.
New Password: <-Enter new valid password
Re-enter new Password: <-Re-enter new valid password
sshd-kbdint: password successfully changed for user
Any idea why this may be happening?
Thanks.
K

Can you use ssh keys instead? This would allow using your own pass phrase associated with the key you create.
ssh-keygen -t rsa
Now copy the *$HOME/.ssh/id_rsa.pub* file to each site and append the *id_rsa.pub* file to the remote account's *.ssh/authorized_keys* file (repeat the copy and append 29 more times).
Now you should be able to connect based on your ssh key and no longer need to enter the long convoluted password. Instead you just need to enter your own selected ssh key pass phrase.
And you can use *ssh-add* after starting your Mac to add your pass phrase to the ssh-agent already running in the background. Once you do this, ssh will ask the ssh-agent before prompting you for a pass phrase it already knows.
This should totally streamline your ssh and scp access to the 30 remote sites.

Changing expired password with OCIPasswordChange

I know that ODP.NET has a option to open a connection with a new password when the old one has expired. I'm using System.Data.OracleClient from .Net instead of ODP because I'm using the Instant Client, which does not seem to work with ODP. Can somebody tell me how to call OCIPasswordChange?

Hi,
OCIPasswordChange is an OCI call. You'd have to write a complete OCI application in C to be able to use that, and OCI coding isnt for the faint of heart.
I do have a complete OCI sample that does it though.. here you go.
Cheers,
Greg
This sample demonstrates the use of OCIPasswordChange once the
password has expired, which requires setting the session into
the service context. Tested with oci 8.1.5, vc++ 6.0 sp3.
first create the user with expired password:
SQL> create user testuser identified by oldpass password expire;
SQL> grant create session to testuser;
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <oci.h>
static OCIEnv          *p_env;
static OCIError          *p_err;
static OCIServer *p_srv;
static OCISession *p_ses;
static OCISvcCtx     *p_svc;
void main()
     int          rc;
     char     errbuf[100];
     int          errcode;
     // Step 1: Initialize OCI
     rc = OCIInitialize((ub4) OCI_DEFAULT, (dvoid *)0,
          (dvoid * (*)(dvoid *, size_t)) 0,
          (dvoid * (*)(dvoid *, dvoid *, size_t))0,
          (void (*)(dvoid *, dvoid *)) 0 );
     // Step 2: Initialize the OCI evironment
     rc = OCIEnvInit( (OCIEnv **) &p_env, OCI_DEFAULT, (size_t) 0, (dvoid **) 0 );
     // Step 3: Initialize the OCI handles
     rc = OCIHandleAlloc( (dvoid *) p_env, (dvoid **) &p_err, OCI_HTYPE_ERROR,
          (size_t) 0, (dvoid **) 0);
     rc = OCIHandleAlloc( (dvoid *) p_env, (dvoid **) &p_svc, OCI_HTYPE_SVCCTX,
          (size_t) 0, (dvoid **) 0);
     rc = OCIHandleAlloc( (dvoid *) p_env, (dvoid **) &p_srv, OCI_HTYPE_SERVER,
          (size_t) 0, (dvoid **) 0);
     rc = OCIHandleAlloc((dvoid *) p_env, (dvoid **)&p_ses, (ub4) OCI_HTYPE_SESSION,
          (size_t) 0, (dvoid **) 0);
     // Step 4: Connect using a mutli-session connect
     rc = OCIServerAttach( p_srv, p_err,
          (text *)"local", 5, 0);
     // Create a server context
     rc = OCIAttrSet( (dvoid *) p_svc, OCI_HTYPE_SVCCTX,
          (dvoid *)p_srv, (ub4) 0,
          (ub4) OCI_ATTR_SERVER, (OCIError *) p_err);
     // Create a session context
     rc = OCIAttrSet((dvoid *) p_ses, (ub4) OCI_HTYPE_SESSION,
          (dvoid *) "testuser", (ub4) 8,
          (ub4) OCI_ATTR_USERNAME, p_err);
     rc = OCIAttrSet((dvoid *) p_ses, (ub4) OCI_HTYPE_SESSION,
          (dvoid *) "oldpass", (ub4) 7,
          (ub4) OCI_ATTR_PASSWORD, p_err);
     rc = OCIAttrSet((dvoid *) p_svc, (ub4) OCI_HTYPE_SVCCTX,
          (dvoid *) p_ses, (ub4) 0,
          (ub4) OCI_ATTR_SESSION, p_err);
     // Open the session on the server
     rc = OCISessionBegin ( p_svc, p_err, p_ses, OCI_CRED_RDBMS,
          (ub4) OCI_DEFAULT);
     // This is a generic error checking routine
     if (rc != 0)
          OCIErrorGet((dvoid *)p_err, (ub4) 1, (text *) NULL, &errcode,
               (text*)errbuf, (ub4) sizeof(errbuf), OCI_HTYPE_ERROR);
          printf("Error - %.*s\n", 512, errbuf);
          // If the error is a 28001, change the password.
          if(errcode==28001)
               // You need to set the Session into the service context
               // before you can call OCIPasswordChange(), and you also need
               // to allocate both the session and service context handles
               // before hand. Then you can call OCIPasswordChange.
               rc = OCIAttrSet((dvoid *)p_svc, OCI_HTYPE_SVCCTX,
                    (dvoid *)p_ses,0,OCI_ATTR_SESSION, p_err);
               rc = OCIPasswordChange(p_svc, p_err, "testuser",8,
                    "oldpass",7, "newpass",8, OCI_DEFAULT);
               if(rc != 0) printf("Password change failed.\n");
               else printf("Password successfully changed.\n");
     // Step 10: Disconnect from the server and free the
     rc = OCIServerDetach( p_srv, p_err, OCI_DEFAULT );
     rc = OCIHandleFree((dvoid *) p_srv, OCI_HTYPE_SERVER);
     rc = OCIHandleFree((dvoid *) p_svc, OCI_HTYPE_SVCCTX);
     rc = OCIHandleFree((dvoid *) p_err, OCI_HTYPE_ERROR);
     printf("Disconnected.\n\n");
     return;
}

Password reset is disabled. Expired password does not cause reset prompt o

Server: Oracle 11.2 on Linux Redhat 64-bit. Installed 32-bit 11.2 Oracle full client on Windows 7 64-bit workstation. Setting up user to test expired password promp capability of SQLDeveloper 3.0.0.4. So far, failing every time. Password Reset on menu is disabled. Loging in or testing in properties (Connection) simply fails with ORA-28001: the password has expired. Not sure how to proceed or enable password reset. FYI, connections only work for connection type of Basic and TNS if I disable OCI/thick driver. When enabled, I get "<oracle_home>\bin\ocijdbc11.dll Can't find dependent libraries"
Not sure how to proceed. Need guidance and instruction or at least point me to documentation please. I'm not finding much on this issue.

Thanks -K- for the response. I'll try that but it shouldn't be the cause of my issue. You see, a few weeks ago, I had SQLDeveloper installed on all our team's 32-bit Windows XP SP3 workstations. The reported issue was occurring then as well. Since then, the 64-bit Windows 7 workstations arrived and the saga continues:-)
Any other thoughts on my issue is appreciated.

Cannot change password expired password

Hi there,
I am not able to change expired password on Windows server 2012. I am getting the error message that "You must change your password before logging on the first time. Please update your password or contact your system administrator or technical support"
I had similar issue in Windows 2008 servers and was resolved when I changed the the RDP security layer to negociate. But I couldn't find Session host configuration snap-in since RDS is not enabled.
Any one faced same issue?
Thanks,
Ranjith

Hi Ranjith,
How are things going?
You could try to change the Security Layer to
RDP Security Layer in the Security section of
Session Collection properties.
In addition, if you are using remote desktop over RD Gateway, there is no support for being able to use the “User must change password at next logon”.
Please refer to these two threads which is similar with your issues.
https://social.technet.microsoft.com/Forums/windowsserver/en-US/320ef31a-1160-4c33-9912-79a3838fc24d/forcefuly-user-should-change-his-password-when-loggin-for-the-first-time?forum=winserverTS
https://social.technet.microsoft.com/Forums/windowsserver/en-US/8761e29a-72a0-4f9c-b31b-ff81633020dd/user-must-change-password-setting-using-rdp-to-server-2012?forum=winserverTS
Hope this helps.
Best Regards,
Tina

Ad-User script to check if expired password = true and email helpdesk

I have a script that runs each day and reminds my users that their password will expire. This works well.
I'm having trouble creating a script to email our helpdesk once the password has expired so engineers can reset it automatically.
The code I have displays nothing yet I know I have expired passwords.
Get-ADUser -filter {(Enabled -eq $True) -and (PasswordNeverExpires -eq $False) -and (PasswordExpired -eq $True)} -properties PasswordLastSet, PasswordExpired, PasswordNeverExpires, EmailAddress, GivenName
Please help!

I looked at a test user meeting these criteria. Although the AccountExpirationDate was in the past, the AccountExpired property was still $False. I'm not sure what process is responsible for changing the AccountExpired property based on AccountExpirationDate,
but this is where your script seems to fail.
This works:
Get-ADUser -filter {(Enabled -eq $True) -and (PasswordNeverExpires -eq $False)} -properties PasswordLastSet, PasswordExpired, PasswordNeverExpires, EmailAddress, GivenName, AccountExpirationDate |
Where { $_.AccountExpirationDate -lt (Get-Date) }
Sam Boutros, Senior Consultant, Software Logic, KOP, PA http://superwidgets.wordpress.com (Please take a moment to Vote as Helpful and/or Mark as Answer, where applicable) _________________________________________________________________________________
Powershell: Learn it before it's an emergency http://technet.microsoft.com/en-us/scriptcenter/powershell.aspx http://technet.microsoft.com/en-us/scriptcenter/dd793612.aspx
Account expired is derived by the Classes. It is not on the raw object. It is all that needs to be checked. If an account is not set to be expired then that will always be false.
Like this:
Get-ADUser -filter * -properties * |?{$_.passwordexpired} | select passwordexpired
You can also do the math.
¯\_(ツ)_/¯

Monitor multiple databases for expiring passwords?

I have created a cutom report in Grid Control that sends a daily report to the DBAs each morning that reports on nonresponsive agents, failed backups, policy violations, etc. I would like to add a section for expired passwords but I'm unable to find that information in the repository. The closest I've come is an alert for "There have been x failed login attempts in the last 30 minutes." but I'd like something that would alert me before the password expires, ideally some configurable number of days before the expiration. Is that information available in the repository? I have considered a user-defined metric but we monitor around 150 databases that do not have common usernames or passwords so I think that would be difficult to maintain.

"I have considered a user-defined metric but we monitor around 150 databases that do not have common usernames or passwords so I think that would be difficult to maintain."
The default profile and all our end-user profiles have password expiration set to 90 days.
What I have done for now is decrease the threshold of the "Failed Login Count" metric to 3 for the Warning threshold since that is the number of attempts a user gets before locking the account. That at least will alert the DBAs if a user has locked an account or an application or automated process is attempting to connect to an expired account.
What would be ideal is if I could report on passwords that have not yet expired but are near the expiration time without having to connect to each database to check but it appears that information is not available in the oem respository.

Normal behaviour for "inactive passwords" setting?

If I have the OD policy for passwords set to "disable after inactive for xx days" - does this take effect if a user is not an interactive logon? ie, I have a user account setup that is used solely for connecting to a share on the server. It never "logs in" like a human would sitting at a mac. A process would connect to a share on the server using this user each day.
Related: Is there any way to setup "do not expire" for users?

Hi Jeffery
As a new user to SAP b1 I have no answer to your question but an observation. I have placed several questions on this forum about Dates because I am convinced that in B1 2007, SAP programmers made a mess in naming Date Field names in such a confusing way that they cannot tell which Date is what. For example in OINV table DocDate field is named Posting Date and in the same table the TaxDate field is named Document Date.
So this is only a guess but perhaps the Date Ranges you are referring to are pointing to the wrong DATE field so it would not work.
Good luck
Robert

Expire password in OID through OIM.

I have password policy set in OIM which has one clause that after 28 days password will expire. I have integrated OID with OIM.
I want that as soon as password expires in OIM, password for that user will automaticaly expire in OID also [without seting any password policy at OID].
Plz reply soon.

Create an entity adapter and attach it on update to the USR form.
In the adapter check what update it is and if a "expire password" fire of a task that goes out to the OID and sets the "password expire" flag.
It was a couple of years since I worked with the OID connector but I quickly checked the task list in the docs and it looks like you have to build your own JNDI based connector. I have some code that could easily be adapted for this purpose. Contact me through LinkedIn if you want it.
Hope this helps
/Martin

User can't change expired password

Hi,
Using Solaris 9 Clients and DS 5.2p4.
In my old NIS+ installation users with expired passwords (not expired accounts!!) where foreced to change their password during login.
Now using ldap naming service, such users are NOT asked to change their passwords, they just can't login, seeing:
Your password has expired.
Access denied
Using keyboard-interactive authentication.
Password:Is this a bug, a feature or do I need to change my config?
my pam.conf looks like:
other   auth requisite          pam_authtok_get.so.1
other   auth required           pam_dhkeys.so.1
other   auth binding            pam_unix_auth.so.1 server_policy
other   auth required           pam_ldap.so.1 use_first_pass
other   account requisite       pam_roles.so.1
other   account required        pam_projects.so.1
other   account required        pam_unix_account.so.1 server_policy
other   account required        pam_ldap.so.1
other   password required       pam_dhkeys.so.1
other   password requisite      pam_authtok_get.so.1
other   password requisite      pam_authtok_check.so.1
other   password required       pam_authtok_store.so.1 server_policyThe only workarround I found so far is, to change the account flag to optional
other   account optional        pam_ldap.so.1This allows the user to login, but he is still not forces to change his password.

There is a way arround.
The password policy which appies to this user needs to have passwordExpireWithoutWarning=off.Than the user gets a "new chance". His passwordexpirationtime gets expended to the current date + passwordWarning periode. This allows the user to login and change his password. In adddition passwordexpwarned=1 for this user is set, to prevent doing this over and over.
See Sun Document 75326
http://sunsolve.sun.com/search/document.do?assetkey=1-25-75326-1
Message was edited by:
mzeilinger

How to deal with expired passwords in authentication schemes?

IHi,
I am trying to build an authentication scheme that deals with expired passwords. After the user has provided their valid but expired password they should be redirected to a password reset page. After they have provided a new password they should be allowed to continue to the page they would have otherwise gone to had their password not expired.
I have written my authentication processs as follows:
CREATE OR REPLACE FUNCTION inventory_test.inventory_authentication (
p_username IN VARCHAR2,
p_password IN VARCHAR2
RETURN BOOLEAN
IS
r1 apex_users%ROWTYPE;
valid_password BOOLEAN;
BEGIN
IF p_password IS NULL
THEN
RETURN FALSE;
END IF;
SELECT *
INTO r1
FROM apex_users
WHERE UPPER (username) = UPPER (p_username);
valid_password :=
DBMS_OBFUSCATION_TOOLKIT.md5 (input_string => p_password
|| TO_CHAR (r1.SEED, '99999')
) = r1.PASSWORD;
IF valid_password AND (r1.password_expiration_date < SYSDATE)
THEN
apex_util.set_session_state ('FSP_AFTER_PASSWORD_RESET_URL', v ('FSP_AFTER_LOGIN_URL')); -- My new application item
apex_util.set_session_state ('FSP_AFTER_LOGIN_URL',
'F?P=' || v ('APP_ID') || ':14:' || v ('APP_SESSION')
END IF;
RETURN valid_password;
EXCEPTION
WHEN NO_DATA_FOUND
THEN
RETURN FALSE;
END;
This redirects the user to the password reset page but FSP_AFTER_PASSWORD_RESET_URL is null - presumably because the login process changes the session.
This seems the wrong approach anyway as the user, once authenticated, can change the page number in the URL and avoid the password reset. I would guess that I need to use the APEX_CUSTOM_AUTH package somehow. However, I am thoroughly confused about the relationship between the LOGIN and POST_LOGIN procedures. Also, I gather from other posts in this forum that there is some asynchronous processing that goes on as new sessions are created. Can someone point me in the right direction please?
--Tony
[http://tonyhasler.wordpress.com/][http://tonyhasler.wordpress.com/]

Sorry for taking so long to acknowledge your helpful suggestions.
Scott's proposal is a tiny tiny bit awkward as,if i understand it correctly, the user would have to reauthenticate after resetting the password.
/dev/null's suggestion is actually not too bad for me. I already have each page being authorised and I use only a limited mumber of (once per session) authorization schemes. I think all I have to do is to place an extra line or two in each scheme to check the expiration date of the user's password and remember to call APEX_UTIL.RESET_AUTHORIZATIONS when the password is reset.
I successfully redirected to the password reset page using owa_util.redirect_url from the post-authentication procedure but what I am still having trouble with is the deep-linking bit. It seems I have to obtain the target URL by 'editing' FSP_AFTER_LOGIN_URL to replace '|' characters by ':' characters and inserting the session id in the right place. Given the fact that FSP_AFTER_LOGIN_URL may not be set and that there may not be sufficient ':' characters in the URL this is very clunky.
Is there an easier way to do this?
--- Never mind. I worked out how to use regular expressions with SQL to do this. A full explanation is in my blog.
--Tony
http://tonyhasler.wordpress.com
Edited by: TonyHasler on Sep 6, 2008 3:17 PM

Every time I try to download a game on my iPad it says please verify your account and follow the intrustion now I have a email n password set up and every time I click send it to my email there is nothing how do I acces this pla

Every time I try to download a game on my iPad it says please verify your account and follow the instructions now I have a email n password set up and every time I click send it to my email there is nothing how do I acces this please

Hi Mark ohara,
Welcome to the Support Communities!
The following articles will help you with your Apple ID verification:
Frequently asked questions about Apple ID
http://support.apple.com/kb/HT5622
Click on My Apple ID to access and edit your account. You will be prompted to verify your email address.
Apple ID: Associating and verifying email addresses with your Apple ID
http://support.apple.com/kb/he68
I hope this information helps ....
Have a great day!
- Judy

MY 2YR OLD LOCKED AN IPHONE 3GS THAT HAS NO SIMS CARD I TRIED ALL KIND OF PASSWORDS IT LOKED ME OUT FOR 15 MINS IS THE PASSWORD THE LAST PASSWORD SET ON THE PHONE

MY 2YR OLD LOCKED AN IPHONE 3GS THAT HAS NO SIMS CARD I TRIED ALL KIND OF PASSWORDS IT LOKED ME OUT FOR 15 MINS IS THE PASSWORD THE LAST PASSWORD SET ON THE PHONE

Please turn off your cpas lock.
All caps indicates shouting, is considered rude, and is difficult to read ( especially when you use no punctuation or sentence structure at all). Many will not read such posts.
Do as the manual says to do and restore the iphone.

"Expire Password" setting

Similar Messages

Maybe you are looking for