0

I'm seeing a strange problem with the ADFS updatepassword page. We're batch-creating users, and they are trying to change their passwords. However, roughly 50% of the accounts can't change their password, the following event is logged:

Password change failed for following user:

Additional Data

User: DOMAIN\username

Device Certificate:

Server on which password change was attempted: ad01.ad.domain Error details: NewPasswordHistConflict

The error would indicate that the password is the same as the previous, but we've tested several different passwords, and still get the same error. I can't find anything special common between the accounts that have problems and those who don't.

The users are created with this Powershell line:

New-ADUser -Name $displayName -DisplayName $displayName -SamAccountName $accountName`
           -GivenName $FirstName -Surname $LastName -EmailAddress $Email -Path $oupath`
           -UserPrincipalName "[email protected]" -AccountPassword $securePassword `
           -Enabled $true

Any ideas? The domain controllers and ADFS is Windows 2012R2.

2
  • I found this, but not sure if it applies to your environment. Take a look: support.microsoft.com/en-us/kb/3035025
    – bentek
    Sep 30, 2015 at 15:52
  • @bentek: Thanks! We've already applied the hotfix so that registering devices is not required, though
    – carlpett
    Oct 1, 2015 at 17:50

2 Answers 2

2

I've seen these types of problems (though not that specific one) because of the minimum password age policy. If set to 1 day it means that once the user changes their password, they cannot do so again for 1 day.

So when you bulk create you need a dummy password because you can't create a user without one and then the user changes the password on the same day etc.

1

I'm not terribly familiar with using ADFS to change passwords, but in my experience, AD doesn't get that specific with why a new password was rejected. It's usually just an error that the new password violated some aspect of the password policy (history, complexity, length, minimum age, etc).

In the interest of troubleshooting though, I'd probably try modifying your password policy temporarily. Start by setting the passwords remembered value to 0 so password history wouldn't be a problem anymore. If that doesn't solve it, keep loosening the policy one setting at a time until your failures go away and you'll hopefully arrive at the real problem.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .