In Active Directory you can set and enforce rules where users have to use strong password, can't use last 5+ passwords they already had, enforce password complexity. Is there a way to enforce such settings so that if a service account (password reset web service) tries to set new password for user it's checked against the policy and is either accepted or denied?
It seems that since the service account is forcing password change user can type in the same password via web interface and keep on using same password over and over again. Since it's a service account changing the password for him it is not checked against last known passwords hence the rules of password are not enforced
While programmer could code a complexity check the last passwords used check can't be checked on web interface because the webservice doesn't have the knowledge of last passwords.
Is it possible to force it so that such change of the password by service account is also restricted like normal user password change would be ?