New password policy causing major headaches

So I was watching a Tedx youtube video the other day that was all about memory.To sum it up, if you create a policy for password (in this case) send out a email to the company about how to make passwords fun. Include a collage of random pictures to help users create new passwords.Collage list from GoogleFun items are much much much easier to remember.So if I had to make a new password as a user, I'd create something fun with the collage and generate a password from that.

We recently put in a password policy that makes everyone change it every 90 days. This last week was the first time everyone's had to update their password, and we ran into a few issues.We've got over 150 users so I don't know if it's user error or what, but I've had half a dozen people over the last couple days say that they changed their password, and now they can't log into the computer. I end up resetting it for them, and then they're good to go again. I feel like maybe they aren't remembering what they set their password to.Also, another half dozen people so far have complained that their phones aren't syncing mail after changing their password. They said they put the new password into their phone, so it should just keep going... but nothing. Some are fixed by removing the profile and re-adding, others I have to go and delete...
This topic first appeared in the Spiceworks Community

Similar Messages

How to create new password policy in FIM

Can anyone assist me is there any way to create a new password policy in fim similar to creating password policy in OIM.Any related inforamtion is useful and appreciated.

Ref to below Link it might give you some idea:
http://www.iamblogg.com/password-policy-violation-exporting-to-ad-from-fim-2010/
Regards~
Deepak Arora
If you Find the Answer | Article | Blog Helpful Please Vote As Helpful / Mark As Answer

How to add new password policy to cn=config via LDIF file

I am trying to add a new password policy called "Service Password Policy". I have the following LDIF file:
dn: cn=Sservice Password Policy,cn=config
changetype: add
objectClass: top
objectClass: passwordPolicy
cn: Service Password Policy
description: A password policy intended for proxy or service accounts.
passwordMustChange: off
passwordChange: off
passwordMinAge: 0
passwordInHistory: 0
passwordExp: off
passwordMaxAge: 2142720000
passwordWarning: 0
passwordExpireWithoutWarning: off
passwordCheckSyntax: off
passwordMinLength: 6
passwordRootdnMayBypassModsChecks: off
passwordStorageScheme: ssha
passwordLockout: off
passwordMaxFailure: 32700
passwordUnlock: on
I've tried various permutations of this command:
dsconf import -h localhost -p 1389 /root/createServicePasswordPolicy.ldif "cn=Service Password Policy,cn=config"
I get this error:
"cn=config": suffix does not exist.
The "import" operation failed on "localhost:1389".
Thx for any help,
CC

Good it did not work or you would have overwritten all the data currently in cn=config. Anyway, "dsconf import" only works on regular backends. The cn=config tree is special a.
You should use ldapmodify to add the contents to cn=config.
$ ldapmodify -p 1389 -D cn=root -f a.ldif -a

What is the new password policy?

What is your new password policy? All you state on the page where it forces us to change without being able to continue is a meter that says whether its strong enough. How about actually stating what the requirements are on that page? Even when clicking on the Password Help link, it doesn’t state what the requirements are. This can be very frustrating to users trying to create a password model.
After toying around with some passwords, I am guessing it is just like 12 characters regardless of whether they are upper/lower case, numbers, or special characters. This policy is really lacking for any type of real security measure.

Hello tmanXX,
Internet security is a topic of much importance and discussion these days. In order to ensure that you and our other customers have the most enjoyable and secure experience, we recently established new requirements for passwords on BestBuy.com. Even so, you ask very good questions about the standards that we have established.
When changing your password on our website, we have a visual indicator to verify your password strength against our criteria. We recommend a variety of letters (upper and lower case), numerals, and symbols deployed randomly for best results. Our standards are not published to add a further obstacle to those who might try to use such information with ill intent. I apologize for any aggravation that you may have endured as a result.
Please know that I'm grateful for your feedback on our password standards and that you took the time to pose your questions and concerns.
Sincerely,
John|Social Media Specialist | Best Buy® Corporate
Private Message

Adding new password policy rules

Can you add new password policy rules in OID 902?
I wish to prevent users from entering a new password that matches their previous 5 passwords.
Can this be done at all?
Regards,
John

We recently put in a password policy that makes everyone change it every 90 days. This last week was the first time everyone's had to update their password, and we ran into a few issues.We've got over 150 users so I don't know if it's user error or what, but I've had half a dozen people over the last couple days say that they changed their password, and now they can't log into the computer. I end up resetting it for them, and then they're good to go again. I feel like maybe they aren't remembering what they set their password to.Also, another half dozen people so far have complained that their phones aren't syncing mail after changing their password. They said they put the new password into their phone, so it should just keep going... but nothing. Some are fixed by removing the profile and re-adding, others I have to go and delete...
This topic first appeared in the Spiceworks Community

How to add a new password policy

This must be simple, but appearantly nobady has conceeded:
"how does one add a NEW password policy to the OID?"
I need this functionality, because I want to enforce the following rules in my SSO application:
- 99% of the users may have passwords that never expire
- 1% (say 5 or 6) users must have passwords that do expire, because they are super users and we want to minimize the risk of their passwords getting in the wrong hands.
I feel almost embarrased to post this question, but I really cannot find any example or documentation that shows me how to add a new password policy.
Is their any way to do this in OID?

Hi,
Can you please provide exact steps those were used to create password policies for users.
I opened a Tar with metalink on this , and they told me that this way is not supported by Oracle.
So if you can please help me with this it will be great. See the details about the Tar as below:
11-AUG-05 21:41:42 GMT
QUESTION
=========
How to create or add a password policy for users in OID according to forum 833683 ?
RESEARCH
=========
- Re: How to add a new password policy
- Oracle Internet Directory Administrators Guide Release 9.2 Chapter 17 "Password Policies"
ANSWER
=======
Oracle Technical Support does not support to create password policies for specific users. Orac
le Internet Directory provides a Password Policy for each subscriber created (al
so known as Realm) or for the entire DIT.
eos (end of section)
I talked with the customer and she agreed to close this TAR.
Best Regards,
Hector Viveros
Oracle Identity Management
@HCL
.

Implement new password policy

Long story short, inherited an existing domain that has this below in place for their password policy. I really need to get them into alignment with us, so I need to change this policy to the second one below. But I know if just went and changed
those settings, every user(there are only about 30 users) would get prompted to change their password the next time they logged in. The domain is 2003, so I know that fine grain is not an option. Is there anything I can do to lessen the blow,
maybe some kind of script that changes the password last set or something like that?? I went and looked at the attribute on a few of these users, they haven't been set in about 8 years.
Enforce password history   0 passwords remembered
Maximum password age   0 days
Minimum password age   0 days
Minimum password length   4 characters
Password must meet complexity requirements   Disabled
Store passwords using reversible encryption Disabled
Enforce password history   10 passwords remembered
Maximum password age 60 days
Minimum password age    1 days
Minimum password length   8 characters
Password must meet complexity requirements   Enabled
Store passwords using reversible encryption   Disabled

"Lessen the blow" ??
Do you mean for you (the admin who would need to deal with lockouts/resets)?
Or do you mean for the 30 users ?
I'd suggest that you try to implement in as few steps as possible. In my experience, progressively enabling password policy settings can be very confusing for end-users, when done in several phases.
Keep it to two phases, is my advice.
1) enable everything except aging/expiry
2) encourage/warn your users that new criteria are in place (length, strength, etc)
3) encourage your users to manually perform password change. This familiarises them with the length/strength requirements, and, you'll get them doing it at slightly different times, allowing them, and you, to handle the volume of assistance calls.
4) enable aging after a few days or two weeks. This means that users who have opted-in early, will only need to deal with the expiry window in ~60 days, and will have been through it recently, and so will be familiar.
Those users who didn't opt-in early via manual password change, will be hit with a forced-change and all-new length/strength concepts to deal with all at once. And you'll get calls from those people, because the Windows password policy dialogs/messages are
quite awful.
Also, consider the impact of your existing (or proposed) account lockout settings.
If these users are technically-savvy (eg are software developers or whatever), they may have many logon sessions running, many devices with cached accounts, etc - this can cause a spike in your account-lockouts, and users who haven't changed passwords in a
long time, often have many cached/saved/stored/concurrent sessions.
We have around 1000 calls at helpdesk for password resets/unlocks per week in our estate. We do have a self-service password reset service. We still get calls. We introduced similar password policies to you, more than 10 years ago. It still causes hellish
Monday spikes in reset/unlock calls.
sigh.
Don
(Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)

Creating a new Password Policy

I am running a Windows 2012 Datacenter domain with Exchange 2013 as a member server. 100% of my users are Outlook Anywhere or OWA users that only use email, so they do not login to the domain on their PC's. I want to create a User password policy and
apply it to specific OU's to force users to change their passwords every 180 days. But I see two issues. One is the Default Domain Policy that is applied to the entire domain, and the other is that it appears that you can only apply a password
policy to a system and not a user.
Does anyone have any guidance or advise. TIA
Larry
Larry D.

I believe what you're looking for is a fine-grained password policy.
Step1 - Create the Policy
http://technet.microsoft.com/en-us/library/cc754461(v=ws.10).aspx Of these options, I recommend using ADSI
Step2 -Linking the Policy
http://technet.microsoft.com/en-us/library/cc731589(v=ws.10).aspx Of these options, I recommend using AD Users & Computers
Hope this helps.

DSCC displays login page when creating a new password policy

Hi, I am new to ODSEE but not new to DS\LDAP :) I have version 11.1.1.5.0 running on tomcat 7.0.26 (on RHEL 5.6 with Java v1.6.0_25-b06). When I click on the password policies tab I get a grey pop-up saying "readwrite" and an OK button. When I click OK the popup goes away and I can then create a new policy. In the "Enter Name, Description and Location" page I enter in all the requisite values and click Next. Then I get the authentication page.
I dont beleive this is normal :) any ideas on what may be going wrong?
Gregor.

From the Tomcat Logs...
16:16:38 | http-bio-8080-exec-58 | com.sun.web.ui.taglib.wizard.CCWizardTag:debugout | /jsp/NewPasswordPolicyPasswordChange.jsp (line: 64, column: 18) Attribute qualified names must be unique within an element
16:16:38 | http-bio-8080-exec-58 | com.sun.web.admin.directory.dcc.WizardServlet:onUncaughtException | uncaught exception
javax.servlet.ServletException: javax.servlet.jsp.JspException: org.apache.jasper.JasperException: /jsp/NewPasswordPolicyPasswordChange.jsp (line: 64, column: 18) Attribute qualified names must be unique within an element
Remember I only got to click next on the first page....

New Stupid Password Policy

Dear Lisa Smith,
Nothing personal but your new password policy is the dumbest thing I have ever seen in my 20 years in the IT world. I am a Sr IT security officer and I am deeply worried about your security practice.
I could create a 100 character password and it would still be hacked if you can't lock down your password db. 8 Characters will do if you have a lock out in place after three attempts... Other wise I can change my password daily and they will laugh as they watch me change it.

Hello and welcome to the forum jimwill47,
I'm very sorry to hear you are frustrated with our new password system. The change was made in an effort to increase security on all BestBuy.com accounts. I sincerely apologize if this change has caused you worry instead.
I appreciate you taking the time to post your feedback, and I assure you I will be documenting your concerns to forward them to our internal leadership team. A password lock out does seem like a good idea, and it is through this kind of feedback from our customers that we are able to focus on the areas that might have an opportunity for improvement.
Once again, I am very sorry for any frustration this may have caused, and thank you again for posting your feedback here on the forum.
Respectfully,
Maria|Social Media Specialist | Best Buy® Corporate
Private Message

Any issue and/or advice with activation of global password policy (10.9 osx server) ?

Hi Pro,
I have an OD domain (10.9.1 server) with 20 users mobile account (10.9.1 osx) authentification, I’d like to enable a global password policy, and I'm curious what actually happens when I add some policy in Server Admin > Open Directory > gear > edit global password policy?
If I set a "reset every 45 days" option, is that from the time the policy is enabled, or from the time the user account was created?
Any issue with Keychain ?
If I set a "must have one letter" or "numeric character", etc...and the user doesn't currently have a password that matches this criteria, will they be forced to set a new password immediately, or the next time one is initiated, did the account will be disable?
I just trying to prevent any bad experience for the users.
Thanks

Hi,
The 45 days will start from the moment you enable that setting for all active users, and will start whenever you create a new OD user.
There won't be any issues with Keychain, it will updated when a new password is set. On that specific day when they login or restart, they need to choose a new password. Keychain will update automatically.
The new policy will start working after the 45 days have been set. After 45 days that policy will be enforced, not before, users can continue to work with a less secure password. About 10 days before that deadline or earlier they will get an option in their login screen to renew their password because it will inform them it will expire soon.
You might want to notify all users of a new password policy when you set it and then inform them again about a week before it will expire. That will ensure a smooth transition...
Goodluck!
Jeffrey

Password Policy Directory 6.2

Hello;
I am trying to implement password policy on directory 6.2. After, I set the following parameters, my instance fails to start. Is there a specific way to turn password policy? Much appreciated!
dsconf set-server-prop pwd-strong-check-enabled:on
dsconf set-server-prop pwd-check-enabled:on
Thanks,
Irfan

Thanks Ludovic;
There are some issues with "messages" that the server displays in 6.2. I got passed the error messages and server is starting. My issue is really setting up a password policy on an ou not using global password policy. I created a new policy in DSCC and assigned to a user. However, that policy doesn't apply to the user. The global policy that I changed to have numeric and upper caps applies to this ou as well -- which is not what I want.
I have a global policy which has numeric and uppercaps etc on o=example.
I have a new password policy (using DSCC) on ou=people,ou=orgexample,o=example. (weak policy -- min length 3)
Somehow only the policy on o=example applies to everyone.
Thanks,

Grace login in password policy

Hi,
Anyone knows if grace logins will be implemented in the next version of directory server?
Rgds,

Yes, grace logins are implemented in Directory Server 6 (which has a new password policy based on IETF internet-draft).
Regards,
Ludovic

Custom Password policy for ProxyAgent

Solaris 10 Server Directory Server LDAP 6.3. Clients are Solaris 10.
The clients use "proxyagent" user located in ou=profile. When I create a Global Password policy and apply to my top level dc, then this service account can "expire". I can't have my service accounts expiring...
How do you create a custom filter with NO account lockout, expiration, etc? The DSCC wizard doesn't allow you to as the last step of the wizard must have a bug because even though you don't click the Lockout radio button, the webpage asks you to fill in a number for account lockout of 1 to 32768. Ugggh.
Question 2: how do you apply a custom password policy to ALL of ou=people? I can do it one by one to dn's under the ou=people, but I want it on the parent so new users get the custom password policy. Everything I try, the Global Password Policy wins. (And can't seem to be done via the DSCC but rather through command line)
Help.
Thanks,
Sean

How do you create a custom filter with NO account lockout, expiration, etc?
The DSCC wizard doesn't allow you to as the last step of the wizard must have
a bug because even though you don't click the Lockout radio button, the
webpage asks you to fill in a number for account lockout of 1 to 32768. Ugggh.Logged a new bug
http://sunsolve.sun.com/search/document.do?assetkey=1-1-6787917-1
The clients use "proxyagent" user located in ou=profile. When I create a Global Password
policy and apply to my top level dc, then this service account can "expire". I can't have
my service accounts expiring...Password policies have to be applied to individual accounts (manually or via CoS). So you
may need to create a new password policy and assign it to the proxyagent user. Since DSCC
does not seem to allow you to do that, best to munge it via the commandline (after specifying
the lockout in dscc). Yes, it's ugly but a bug has been logged. Please contact Sun Support if
you want a fix against 6.3 (quote the above bug number)

Password Policy on Directory Server 11.1.1.7.2

Hi,
I'm trying to set up a password policy with DS 11.1.1.7.2 but it doesn't seem to be getting applied to the users. I went through the DSCC gui and created a new policy that is supposed to remember the last 3 passwords and also expire in a couple days just for test purposes. I then set the compatibility mode to Directory Server 6 and clicked on "Assign Policy" and selected ou=people,o=xxxxxx,o=isp where my test accounts are.
I've then tried using ldapmodify using the credentials to the accounts who's passwords I'm changing and it allows me to reuse the same passwords. I saw something about using a virtual attribute for assigning users to a policy. Is that required also?
dn: cn=TestPWpolicy1,o=xxxxxxx,o=isp
cn: TestPWpolicy1
objectclass: sunPwdPolicy
objectclass: pwdPolicy
objectclass: ldapsubentry
objectclass: top
passwordrootdnmaybypassmodschecks: on
passwordstoragescheme: CRYPT
pwdallowuserchange: true
pwdattribute: userPassword
pwdcheckquality: 2
pwdexpirewarning: 86400
pwdinhistory: 3
pwdmaxage: 172800
pwdminage: 0
pwdminlength: 2
pwdmustchange: false
createtimestamp: 20150302195541Z
creatorsname: cn=admin,cn=administrators,cn=dscc
entrydn: cn=testpwpolicy1,o=xxxxxxxx,o=isp
entryid: 28
hassubordinates: FALSE
modifiersname: cn=admin,cn=administrators,cn=dscc
modifytimestamp: 20150302195541Z
nsuniqueid: 0a0ca681-c11611e4-800799c3-4c540d75
numsubordinates: 0
parentid: 2
subschemasubentry: cn=schema
Thanks for any help.

Hello,
A user entry references a custom password policy through the value of the operational attribute pwdPolicySubentry. When referenced by a user entry, a custom password policy overrides the default password policy for the instance.
It is unclear to me whether you want to assign the new password policy to an individual account or to every user in ou=people,o=xxxx,o=isp.
To assign a password policy to an individual account, just ddd the password policy DN to the values of the pwdPolicySubentry attribute of the user entry e.g.
$ cat pwp.ldif
dn: uid=dmiller,ou=people,o=xxxxxxx,o=isp
changetype: modify
add: pwdPolicySubentry
pwdPolicySubentry: cn=TestPWpolicy1,o=xxxxxxx,o=isp
$ ldapmodify -D cn=directory\ manager -w - -f pwp.ldif
Enter bind password:
modifying entry uid=dmiller,ou=people,o=xxxxxxx,o=isp
$ ldapsearch -D cn=directory\ manager -w - -b dc=xxxxxxx,o=isp \
"(uid=dmiller)" pwdPolicySubentry
Enter bind password:
version: 1
dn: uid=dmiller, ou=People, o=xxxxxxx,o=isp
pwdPolicySubentry: cn=TestPWpolicy1,o=xxxxxxx,o=isp
$
See Directory Server Password Policy - 11g Release 1 (11.1.1.7.0)
You can also assign a password policy to a set of users using cos/roles virtual attributes as described in section 8.3.4 at Directory Server Password Policy - 11g Release 1 (11.1.1.7.0)
-Sylvain
Please mark the response as helpful or correct when appropriate to make it easier for others to find it

New password policy causing major headaches

Similar Messages

Maybe you are looking for