I have a requirement for one of my clients that they would like all user passwords stored in the Description field of AD.
Now this is all well and good initially because we use a script to roll out new users. However the problem comes because another one of their requirements is to have passwords changed on logon.
So in effect, they'd like a user to logon initally, change their password and have that new password automatically saved into an AD attribute.
The only thing I can think of at the moment is to do this via a logon script, that shows a password change prompt and does the change and logs it into the attribute of that user account then change the logon script to a correct one for everyday use.
Is there any other way of doing this through the built in 'must change password on next logon' setting or am I already looking at the best way of doing this
Alright well, I know it's a bad idea. What i'll end up doing is using a password filter as in one of the answers and just save the passwords outside of active directory and just pass the file on to ICT staff manually