OIM AD Integration - 'User must change password at next logon'

Hi,
These are the issues in OIM AD integration that we are stuck up on:
Issue:
1. When OIM Admin resets the password for User1 in OIM, the password is propagated to AD but the ‘User must change password at next logon’ attribute is not updated in AD. As a result, if the User1 logs into AD account (i.e. computer), there is no prompt to change the password.
2. When AD Admin resets the password for User1 in AD and checks the ‘User must change password at next logon’ flag, the password is propagated to OIM but the ‘obpasswordchangeflag’ attribute (of oblixPersonPwdPolicy class) is not updated in OID. As a result, if the User1 logs into OIM account, there is no prompt to change the password.
Research:
1. For case 1 above: When OIM Admin resets the password for User1, the ‘User must change password at next logon’ attribute on the AD process form itself is not getting updated. So the AD Connector doesn’t propagate the attribute to AD.
2. For case 2 above: When the AD Admin resets the password for User1 in AD, the AD Password Sync connector only sends the password to OIM and not other attribute. So, there is no way to fetch the ‘User must change password at next logon’ attribute and then copy it into ‘obpasswordchangeflag’ attribute in OID.
Environment Details:
1. OIM-OAM-OAAM 11.1.1.5 BP02 integrated using OVD-OID 11.1.1.5
2. AD on WIN 2008 R2.
3. OIM AD Connector 9.1.1.7.2
4. AD Password Sync Connector 9.1.1.5
Any help would be highly appreciated!
Thanks,
Kulesh...

Thanks for your reply again.
I did not get you completely here. Can you please elaborate on the "process task on the AD Process which passes along the USR_PWD_MUST_CHANGE and immediately sets it to 0 this should work". How many total additional tasks would be needed here?
what all targets are you provisioning the password to?
- AD and OID (through LDAPSYNC)
where are end users allowed to change their passwords on (OIM,AD....??)
- Both OIM and AD.
Where can admins change the passwords?
- Currently they use ARS for such purposes but this is something we need to clearly define. The thing is, they use ARS for whole lot of purposes and we can't dictate/restrict them to use OIM only for password resets. So they may use ARS or OIM.
What do you suggest?
Edited by: Kulesh Kane on Nov 8, 2012 11:43 AM

Similar Messages

User must change password at next logon?

Hello,
We have an XMII / LDAP connection to AD. (Both read and write). But when ever we set a user in our AD to change password at next logon, they get block from logging into Xmii.
The funny part about this is if we do the following:
1: User login into Xmii
2: Administratator on AD controller, sets the flag "User must change password on next logon"
3: User selects Logout.
Now the user gets promt of changing his/her password.
Anyway to fix this?

Well we have some clients that doesn't use the same login to MII and for their workstation.
Basicly i want so whenever i set the flag "User must change password at nextlogon" in AD, I want MII to see that and make the user change his or her password in the portal.

"user must change password at next logon" flag for multiple users

2008 R2 domain with a couple of 2012 R2 DCs.
john.user is in the Users OU. if I right-click john.user, choose properties, go to the account tab, and check "user must change password at next logon," the next time john.user tries to log in, he gets prompted to change his password. also the
powershell command
get-aduser -filter * -Properties * | ? name -like "*john.user*" | select name,pwdlastset
shows that john.user's pwdlastset is 0. all of this is as expected.
but if I highlight every account in the Users OU, right-click, properties, Account, "user must change password at next logon," it appears that nothing whatsoever happens. john.user doesn't get prompted to change his password at his next
logon, and his pwdlastset is something like 130622757432306111.
is this the expected behavior? why are the Account tab and/or the "change password at next logon" box available to me when selecting multiple users if they aren't meant to work?

ah. thank you sir. *two* checkboxes. *two.* of course.
I had enough OUs under my Users OU that I just used powershell to catch them all at once:
$enabledusers = get-aduser -filter * -SearchBase "ou=users,dc=domain,dc=local" -Properties distinguishedname,pwdlastset |
    where {$_.enabled -eq "true" -and $_.distinguishedname -notlike "*ou=service accounts*"}
foreach($enableduser in $enabledusers) {
    $enableduser.pwdlastset = 0
    Set-ADUser -instance $enableduser

Exchange 2013 OWA user must change password at next logon not working

Hi,
I have installed Exchange 2013 on Windows 2012 Server. I create users in ECP and select "user must change password at next logon" option. When newly created user logs in, the OWA page doesn't prompt for password change and just throws error "The
user name or password you entered isn't correct. Try entering it again"
I have enabled Change Password feature in CAS server, but still not working.
Any answers, suggestions would be great help
Regards
Sunil

Hi Sunil,
Have you tried as Martina said and does it work?
If not, please try to set the Minimum Password Age to 1 according to link below. I found some threads which are similar to yours and were solved by this way in Exchange 2013 environment.
http://support.microsoft.com/kb/827614
And for further troubleshooting, please create a new user with "user must change password at next logon" option checked and see if he can log on domain-joined PC.
In addition, please check the event log to see if there is any related error message.
Regards,
Rebecca

Windows 2008 Terminal Server "user must change password at next logon" problem with Windows 7 client.

Hi,
I have a fully patched Windows 2008 SP2 Terminal Server and a fully patched Windows 7 client.
I have logged into the Windows 2008 SP2 Terminal Server server with a test account via RDC before.
When I try to log in via RDC to the 2008 TS with a test account which has been marked with the setting "User must change password at next logon" I get the RDC message "You must change your password before logging on the first time. For assistance, contact your system administrator or technical support." I need to force the user to change their password once it has been issued, any ideas on how this can be done?
Thanks,
Dan

This does not resolve my issue all the way. I'm having the same problem; When i'm "deploying" users, i always want the users to set their own passwords. Ok, so I then set the auth mode to "RDP Security layer". It seemed to work fine, and it does for that
special purpose.
Just like Daniel, my clients are connecting to our terminal server from several/different "customer-domains" So, they can't logon locally(on their local computer) and change their password, it has to be done THROUGH the terminal server.
But if I turn on RDP Security Layer, users can't use remoteapp through tsgw they only get: "Your Remote Desktop Connection Failed because the remote computer cannot be authenticated" Any ideas?
Also, our terminal servers is round robin based in a farm. So users connect to: tsfarm.domain.com(yes, public a-record which resolves to two internal adresses) This is because, we're using a wilcard *.domain.com as SSL certificate.
But, when i'm using this, our clients sometimes get double auth when they login. I only get the double auth when tsfarm.domain.com resolves to server A, but the session broker wants the user to be on server B.(load balancing)
This does not occur when SSL is enforced, any ideas?

Network account - Having "user must change password at nex logon checked" - does not allow user to login

Hi,
We have several SharePoint 2013 sites which, when the option called "User must change password at next logon" is checked on a user's Active Directory account, the user is not allowed to login to the SharePoint site. Is this something that needs
to be changed on the SharePoint end to resolve?
thanks,
Sherazad.
Sherazad

You need to look at a different solution that allows this, e.g. home-grown solution, 3rd party, and I believe Forefront Identity Manager can also accomplish this task. There are quite a few self-service password management solutions out there. Search on
that term, and you should be able to find something that works for you.
Trevor Seward
Follow or contact me at...
This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

TMG 2010 publishing Exchange 2010 OWA cannot change password if user must change password at first logon is set

Hi,
I have an odd issue whereby if I set "user must change password" on an AD account, the end user cannot logon, they're simply taken back to the OWA login page as if their password is incorrect.
My setup is as follows:
outer TMG -- uses a listener for email.contoso.com and is configured for no authentication.This uses a publishing rule to publish the inner TMG server. This server is not a domain member.
inner TMG - uses a listener for email.contoso.com and is configured for NLTM\kerberos negotiation with forms authentication (Windows Active Directory). This server is a domain member and use a publishing rule to publish the internal CAS. Allow users to change
password is selected in the publishing rules.
Exchange 2010 SP1 - uses integrated windows and basic authentication. Has the appropriate registry key configured to allow users to change their AD password on first logon.
I've registered an snp for "http/email.contoso.com mailserver-dc1", all SSL certificates being used are valid and my configuration used to allow users to login and change their password with "user must change password on first login"
set in AD.
If I launch a web browser on an internal server and point it to email.contoso.com I'm immediately presented with a generic Windows authentication request (similar to what's seen in ADFS) rather than the standard OWA page. No matter what I do, I cannot login
and change my password using the correct URL. However if I point my browser at
http://192.168.4.10/owa I'm prompted to login and I can change my password using the sam credentials.
The only recent changes made are:
- Disabling SSL 3.0 and enabling TLS (http://www.isaserver.org/articles-tutorials/configuration-security/improving-ssl-security-forefront-threat-management-gateway-tmg-2010-published-web-sites.html)
- Replacing the TMG listener certificates so that they now use SHA2 rather than SHA2 (certificates are trusted on each TMG server)
Looking on the outer TMG and the DC logs I can see schannel errors which I believe are related to the problem. TMG monitoring also shows "Failed connection attempt: 1907 The user'spassword must be changed before logging on for the first time"
I've checked that my inner TMG and DC are using the same certificate for server authentication and gone through this guide:
http://blogs.technet.com/b/keithab/archive/2012/02/29/setting-up-and-troubleshooting-ldaps-authentication-in-forefront-tmg-2010.aspx
If I try to use ldp.exe on the inner TMG, I get the error in the pic below
Thanks
IT Support/Everything

Hi,
You could try to analyze the TMG tracing and try the troubleshoot steps in the blog below.
TMG 2010 – FBA, troubleshooting the change password feature
http://blogs.technet.com/b/isablog/archive/2012/05/07/tmg-2010-fba-troubleshooting-the-change-password-feature.aspx
Best Regards,
Joyce

Reconciliation of "change password on next logon" from AD fails in OIM 11g

Hello,
We have a use case on our OIM 11g project where we create a user in Active Directory and check *"User must change password at next logon"* box in AD.
We have setup AD as Trusted and Target resource (using connector 9.1.1.7), where users coming from AD will be created in OIM and password changes in OIM will be sent to AD. Also we use the password synchronization module (9.1.1.5) to synchronize the passwords from AD to OIM when they are changed in AD.
What we noticed is the "User must change password at next logon" is synchronized to the "AD Resource", but unlike the regular attributes it is not accessible normally because it's a system attribute.
What we expect is the user logging in to OIM will be prompted to change the password, but nothing happens when the newly reconciled user logs in (i.e. normal self-service page is shown). Same thing applies when we set the flag on an existing user also.
Did anyone get this working properly?
P.S. In a previous version it used to be the opposite where the user was constantly prompted for the password, even though it was changed in AD already, after changing the password using Alt+Crtl+Delete the user was still prompted to change when logging in to OIM. Oracle suggested we upgrade to 11.1.1.5.1 (most recent patch set) but now the reverse happens - we never get change password prompt now.
Thanks,
-JP
Edited by: JacekP on Oct 17, 2011 8:10 AM

Yeah, you're right, unfortunately we have dual authorative password model, where a user can change the password from OIM when he is accessing a OIM through a web interface or from his Windows machine through the domain controller. We need the use case to work fully both ways ideally.
A plan-B solution is to use a directory synchronization mechanism outside of OIM that would connect OID and AD, but we would prefer not to.

User must change password after reset?

I am looking at the password policy settings and am wondering what "User must change password after reset� actually does. I turned it on. I tried changing some passwords in an ldap client and didnt get any messages or errors after authn again. And I didnt see a special attribute in the persons entry. Any clues?

When the flag is enabled and the password is changed by "cn=directory manager", the next time the user authenticate, the server returns the Password Expired Control (with a Success code) and all requests other than modify of userPassword are rejected.

Number of days before user must change password.

Hi,
I understand how does this Essbase server setting work:
Essbase Server Properties - Security Tab
"Number of days before user must change password"
But my question is:
Does anyone know how "to mark" certain group of Users (mainly system admin accounts) - that this setting will not force periodical passoword change for "marked" users ?
Any ideas ?
Br, ripasso

There are a couple of things you could do to circumnavigate this all or nothing option.
You could write a maxl statement that would update the user profile to force the user to change their password e.g.
alter user Fiona set password_reset_days immediate;
I would write a program using the API that lists all users in the group and then dynamically create the maxl script that uses the statement above.
If you can not use the API then I guess you could do a maxl only solution (using display user command) and do some text file manipulation in perl (or another scripting language).
There are probably more solutions/ideas out there.

Create a user through the API and "Prompt user to change password after next login".

Using the Adobe Connect Interface, I can create a user and check the checkbox to "Prompt user to change password after next login".
Can I achieve the same result using the API? The principal-update action doesn't offer such an option and, as far as I can tell, there isn't another action to do so either.
Thank you.

You can achieve it as part of your application functionality, but not as a configuration option on WLS.

ISE 1.1 'Change password on next logon' fails on iPhone / iPad

Hello -
We're in the process of implementing an ISE 1.1 server for Guest Wireless Access / BYOD at our company and ran into an issue with authenticating from iPhones / iPads when the account is set with 'change password on next logon' (it's a local account created on the ISE server - not AD). It fails and displays 'unable to join network' on the iPhone. The ISE log shows a '5411: No response received in 120 seconds'. We're able to authenticate from Windows devices and are prompted to change the password during the authentication process. Has anyone else encountered this? If we uncheck the 'change password' box we can authenticate from iPhones & iPads without any issue but we need to have a way for users to set their own password.
Thanks!
Bill

Hi,
I am encountering the exact same issue in our lab environment, but with AD accounts (We would like customers to be able and connect to the dot1x network with their AD credentials, and based on machine authentication they will or will not get restricted access).
Just to be clear: the change password functionality works perfect on laptops, but on ipad/android we just cannot connect to the dot1x (PEAP) network when the "change password on next login" checkbox is on.
Anyone else who can shed some light on this?
Thanks
Tom

How to disable change password at next logon field

Hello,
I want to disable change password at next logon field,so could anyone tell me how to do that & what is
the column name in USR table for change password at next logon field.
Thank-You
Rahul Shah

For 9.x
Open FormMetaData.xml and comment the below lines
<Attribute name="-31" label="createuser.label.changePwdAtNextLogon" displayComponentType="CheckBox" variantType="String" dataLength="1" map="Users.Change Password At Next Logon" />
<AttributeReference editable="true" optional="true">-31</AttributeReference>
Now open design console go to Administration->>System Configuration and search for keyword XL.ForcePasswordChangeAtFirstLogin. Set this value to FALSE.
Dont forget to restart the server.

User cannot change password option is automatically getting unchecked while giving domain admin rights

user cannot change password option is automatically getting unchecked while giving domain admin rights

Greetings!
"Domain Admins" falls into the category of protected groups and it is included in ADminSDHolder process. It is normal and was designed in order to prevent the modification to these privileged groups. More information on the link below:
AdminSDHolder, Protected Groups and SDPROP
Regards.
Mahdi Tehrani |
|
www.mahditehrani.ir
Please click on Propose As Answer or to mark this post as
and helpful for other people.
This posting is provided AS-IS with no warranties, and confers no rights.
How to query members of 'Local Administrators' group in all computers?

How to Restrict users to change password

Hi All,
I would like to restrict user to change password only defined number of times in a day, Is it possible to do it through group policies.
Please note i am already aware of "Minimum Password age" feature, however i do not want to use it as the minimum value that i can set here is 1 day. I would like to restrict users based on password reset threshold e.g. User can reset his password
in a day only twice or thrice.
Thanx & Regards,
Wasim Parkar

If you want to limit the user to have his/her password changed for a specific number of time every day, I have to say
NO thats not possible. PSO's as other mentioned,can be used to have different password policies. Maybe you can set the msDS-MinimumPasswordAge
to 00:04:00:00 which is equal to 4 hours. It means every 4 hours a user will be able to change his/her password. So in each day a user can change the password 6 times, since a day is 24 hours.
Do not forget a day start from 00:00 AM up to 11:59 PM. So in a 9 to 5 job, a user may change the password 2-3 times.
Hope it helps.
Mahdi Tehrani Loves Powershell
Please kindly click on Propose As Answer or to mark this post as
and helpfull to other poeple.

OIM AD Integration - 'User must change password at next logon'

Similar Messages

Maybe you are looking for