User must change password at next logon in AD

[DushyantSingh]

How could we enforce “user must change password at next logon” = true for new users in AD ? For this we are flowing pwdLastSet = 0 through IMG for new users , but this is not reflecting in AD.

[BorisLekumovich · Accepted solution]

try using the following parameter

Field Name	Value
Parameter Name	_AFX_FORCE_REGISTER_USER_CHANGE_PWD
Type	STRING
Default Value	-
Is the parameter required?	No
Is the parameter encrypted?	Yes
Display Name	Force Password Change
Mapping	${AccountTemplate.Password}
Description	While creating new user on AD, if you want to force reset password on first login, you need to add “_AFX_FORCE_REGISTER_USER_CHANGE_PWD” parameter to the capability “Create an Account on an AD server” and set its value to 1

[UlrichSchulz]

Boris beat me on this

Just to add to this: The reason is that the connector needs to create the account first before it can set the password (your initial password for the account creation). You set pwdLastSet to 0, but then the connector sets the initial password and as a result you will see the current date in pwdLastSet. The special variable _AFX_FORCE_REGISTER_USER_CHANGE_PWD solves this issue.

[VishwanathBaba1]

Boris,

I tried setting _AFX_FORCE_REGISTER_USER_CHANGE_PWD=1 (tried - 0, tried without pwdLastSet atribute, tried selecting 'Encrypted' check box), but even that did not work. Below is the AFX capability:

Any idea on why it's not working?

[BorisLekumovich]

what version are you testing on?

[BorisLekumovich]

I've tested it on 6.9.1 P07

Here is my connector configuration

I've used the Test Connector Capabilities to test the different behavior.

First time, the value of the parameter  _AFX_FORCE_REGISTER_USER_CHANGE_PWD is 0. Here is a screenshot from AD

Second time, the value of the parameter  _AFX_FORCE_REGISTER_USER_CHANGE_PWD is 1. Here is a screenshot from AD

[VishwanathBaba1]

I am on 6.9.1 P09. Using AFX test Connector capability. Result is still the same with  _AFX_FORCE_REGISTER_USER_CHANGE_PWD = 0:

[BorisLekumovich]

I guess I mixed up the test results in my previous reply

I've just tested it on v6.9.1 P09 now.

I've configured the parameter  _AFX_FORCE_REGISTER_USER_CHANGE_PWD = 1.

The account was created with pwdLastSet = (never)

Try on your environment with the same values I tried.

[VishwanathBaba1]

Boris,

It worked. Thank you so much.

[AndreaSaldamarc]

Hi,

I have created a custom request form (Register User Form) in order to create an account on Active Directory.

To fulfill the request I use a Register User Command (Non-Visual).On AD Server the UserAccount is created but in Account Options tab,  the "User Must Change Password at Next Logon" field is selected (as shown in the following picture) and in my UseCase does not have selected!

 

I have added a "_AFX_FORCE_REGISTER_USER_CHANGE_PWD" (Value 0) parameter in AFX Capabilities but when I run the form the form on AD I have always the parameter selected. Why?

NOTE: If I test the CreateAccount capability in AFX Test mode It work correctly. So the error depends on the form?

Thanks in advance

Kind regards

Andrea Saldamarco