Password reset customization

Question

We are running 2008 R2 Active Directory, staff log in to Windows machines on the domain so we have no issues with password reset settings there.
The issue we have is that we have students logging in from remote sites via a portal that, whilst using AD authentication, does not give students access to AD. The problem I have been asked to solve is this. When a student forgets their password they contact
the service desk and request a reset. The service desk have password reset rights BUT they do not have direct access to AD, they use an admin password reset tool on the portal which allows them to reset the users password.
This works as far as it goes, but the issue is we cannot enforce the "reset password at next logon" because the portal does not recognize this, it simply says the password is incorrect and denies access.
I need to be able to find a way to enforce a reset at next logon, or at least within 24 hours. The original request was to disable the account if a reset is not done within 24 hours, though that causes other issues as I am not sure how I can reset the auto
disable when the student does a reset.
Has anyone come across this type of requirement before? Is there a magic way to make this happen without having someone check each student account every day to make sure it isn't going to expire? Is there some miracle cmdlet in powershell that will let me
set this?
If anyone has any ideas I'd love to hear them, I'm hitting a brick wall.
Thanks

Answer 1

On Mon, 31 Mar 2014 14:07:24 +0000, GADavies wrote:
But that's the point. If a user knows their old password they can already reset it on their own. the issue is with people who do not remember their password. They need to have it reset by the administrator, however_if this is then set to force a reset at
next logon they_*_CANNOT LOG ON_,* they are NOT logging into AD but the authentication is done via AD. The check mark to force a reset at next logon is set, but all it does is reject their credentials on the portal which equates to they cannot log on. So we
either have them using a password known to others for up to 90 days, stop them from logging on by checking the reset at next logon box or try to come up with a solution that allows them to log on using the administrator provided password for a short time
during which they can select to reset it via the self service password reset option.
The bottom line here is that there is no way to accomplish what you want
out-of-the-box. You're either going to have to find a 3rd party application
you can deploy for this, or you're going to have to develop your own
in-house application.
Paul Adare - FIM CM MVP
Debian: when you have better to care about than what CPU is in the box.
-- Bill Allombert