Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have an Active Directory network with a mixed environment of Macs and PCs, including some remote users who connect via VPN. We're trying to implement a password expiration policy, but we've run into the roadblock such that when a Mac's password is expired on AD, it can't connect period - no prompt or opportunity to change password, no nothing. This goes double for a VPN client synced with the domain password.

Surely there's a piece of middleware or something that bridges this gap. Any thoughts?

share|improve this question
What do you mean by "Mac"? Please describe which version(s) of Mac OS X your clients are running. Starting with 10.6.8 AD password expiry (shows remaining days) and renewal is supported(tm). – pfo Mar 30 '12 at 15:39
I think that that information is largely part of the answer, and worth posting as an answer below. – Chris B. Behrens Mar 30 '12 at 17:16

We have a scheduled task that runs daily and emails users at predefined password age intervals. E.g., if our password age is 90 days, email them at 75 days, 80, 83, 85, 87, and 89 days.

share|improve this answer

Take a look at ADPassMon It will notify the local user when a change is needed.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.