Questions tagged [password-policy]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
20 views

Deploy password policy for Cloud m365 accounts

Does anyone know how to deploy a password policy in a 100% M365 cloud user environment?
Tek's user avatar
  • 1
0 votes
1 answer
301 views

How do you enforce a custom password policy on LUKS FDE (Ubuntu 22)?

I need to enforce a strong custom password policy for LUKS FDE on Ubuntu 22. I have successfully enforced it on the user account level by modifying /etc/pam.d/common-password. But the restrictions in ...
fastraul's user avatar
0 votes
1 answer
530 views

bad password count in different sites

What happens if a user try wrong password in different DC (sites), how come the lockout occurs after meeting threshold bad pwd count? Account lockout threshold value is 3 for eg i have 3 sites - Site ...
Sandy Santhosh's user avatar
0 votes
1 answer
123 views

OpenLDAP to 389-DS: Can I have "named password policies"?

I'm trying to understand how "password policy" works in 389-DS, compared to OpenLDAP 2.4: In OpenLDAP 2.4 I could define multiple "named" password policy entries, and assign those ...
U. Windl's user avatar
  • 383
0 votes
1 answer
644 views

Can the Maximum machine account password age be set differently for one OU on a domain controller

In my organization, when we provision a computer one of the steps includes joining our domain. Typically we provision one pc at a time as the need comes up. I would like to get out of this habit and ...
Rich Kiroy's user avatar
0 votes
1 answer
5k views

Password does not meet the password policy requirements

I keep getting the "Password does not meet the password policy requirements" message when trying to reset existing user passwords / create passwords for new users. I am logged into a Windows ...
Ash's user avatar
  • 458
0 votes
1 answer
1k views

Ansible: how to run subsequent task for only newly created users?

The user creation policy in our organization is to force changing password on first login and use SSH keys for remote connections; the password is only used to run sudo or login locally. To force ...
Nikita Kipriyanov's user avatar
0 votes
1 answer
164 views

Nextcloud ignores openLDAP password policy

I have a NextCloud server which is connected to an openLDAP server. All users can change their passwords which should follow a password policy. For users which only have a NextCloud account, this ...
Arne Fallisch's user avatar
-1 votes
1 answer
335 views

account lockout policy - what happen user tried logon with wrong password 3 and use the correct PWD on 4th time?

Password settings attribute in question: A number of failed login attempts value set to 4. Reset failed logon attempt counter reset to after 1 min Scenario: When the user use the wrong password to ...
Petricia Flores's user avatar
1 vote
0 answers
439 views

PAM module configuration, ssh failure in Debian

I want to set password policies for users on a Debian VM, like minlen and special char required for the password. In my Debian VM I get an error and can´t log in again via SSH to that machine. OS ...
nemo's user avatar
  • 11
0 votes
1 answer
2k views

Fine Grained Password Policy Not Taking Effect - have to wait for next password change?

I have set a Fine Grained Password Policy with maximum password age of 180 days along with other settings that are similar to existing password policies. I set the precedence number to a lower number ...
Cell-o's user avatar
  • 327
1 vote
2 answers
2k views

Password history in Active Directory

We are considering enabling "Enforce password history" on our Active Directory, the password is now maintained by another IAM system, but we are looking into changing it to AD/AAD. Users has ...
Raymond A.'s user avatar
1 vote
2 answers
986 views

If user passwords are set to automatically expire within a Windows domain, does this have an impact on the force password change checkbox within ADUC?

Assume the following: A Windows domain has a policy set to ensure that users must reset their passwords every 90 days A user account (let's refer to it as "UserA") last changed their ...
elliott94's user avatar
  • 165
0 votes
1 answer
127 views

Windows On-Prem Active Directory - Moving from GPO based Password Policies to Fine Grained Access

It has become a requirement for us to have more than one password policy on the same domain. I have been doing some research and it looks like the way to achieve this is through Fine Grained Password ...
RLBChrisBriant's user avatar
0 votes
0 answers
157 views

Password expiration on windows 2008 DC - User not prompted to change pw on Windows2019 RDS

We are upgrading/replacing old Windows 2008 servers. We have not been able to upgrade the 2008R2 DC yet, but the 2008R2 RDS server are replaced by 2019RDS server. When password expired on an user ...
Henrik Ormåsen's user avatar
0 votes
1 answer
640 views

Openldap re-hashes already hashed password

I have an openldap with ppolicy on SSHA-512. When clear text password is sent from client, the password will be stored as SSHA-512, fine. My problem appears, once already hashed password is send e.g ...
FastFoot's user avatar
2 votes
1 answer
984 views

GPO Password Policy Only Partially Applied

We are trying to modify our existing password policy that is being applied via GPO. For some reason it is not applying any of the settings in the password policy section (Comp Config > Policies > ...
yougotiger's user avatar
2 votes
1 answer
2k views

how to set pwdMaxAge for a single user in OpenLdap

If I do this, it is applicable to all users. ldapadd -v -H "ldaps://hostName/" -x -W -D cn=admin,dc=mydomain,dc=com -f pwdMaxAge.ldif dn: cn=passwordDefault,ou=Policies,dc=mydomain,dc=com ...
james's user avatar
  • 33
1 vote
1 answer
65 views

Give user's directory access to another user

Users are sharing their password. As you know, this is bad! The big reason why they do that is to allow a colleague to access theirs files when they are away. Yes, they can plan this in advance, but ...
Francis's user avatar
  • 481
0 votes
1 answer
503 views

Cannot find Passfilt.dll on 2008 DC

I am trying to locate the standard password filter program called passfilt.dll on my 2008 DC. I searched the whole C drive but I could not find it. According to documentation, it should be in c:\...
J Lee's user avatar
  • 11
1 vote
1 answer
2k views

Sudo: cannot setup user to avoid being asked for password

I run: sudo visudo and set this line for my user myuser ALL=(ALL) NOPASSWD: ALL however, I am still asked a password when I run a sudo command how can I setup the user so that the password ...
Daniele B's user avatar
  • 367
2 votes
0 answers
143 views

Windows Domain Password Policy Issue

I just discovered something odd happening with a password policy in one of the Windows Server 2012 R2 environments we manage, and we have had no luck finding any information to explain the behavior. ...
Jesse P.'s user avatar
  • 201
4 votes
1 answer
557 views

Apply New Password Policy via GPO Gradually

I want to make changes to the password policy in our domain (for example, include password complexity) but I want to apply it gradually, to some OU's or users group first. As far as I know the ...
Alberto Medina's user avatar
0 votes
1 answer
334 views

ppolicy not enforced on OpenLDAP Client when using 'passwd'

The issue: Password Policy is not being enforced when I change the password using the 'passwd' command. It is enforced when I use the 'ldappaswd' command. But the OpenLDAP password still changes using ...
Ram Krishnan's user avatar
0 votes
1 answer
2k views

Why am I not seeing the user lockout message?

When I try to login 3 times with the wrong password (locally), instead of seeing user locked out message: su - myuser Account locked due to 3 failed logins I see this: [myuser@ip-10-10-2-53 ~]$ su -...
alexfvolk's user avatar
  • 174
2 votes
2 answers
4k views

How to use PAM to manage lockout policy for ssh public key authentication methods

I have followed instructions on redhat on how to harden authentication on a linux server, but we only use SSH with public key auth. According to these instructions: https://access.redhat.com/...
alexfvolk's user avatar
  • 174
1 vote
4 answers
2k views

Do password expiry rules reducing the security of the system?

The problem I regularly have a debate with my CTO which usually begins something like this ... CTO: My password expired, that should never happen. Me : It's a security risk to never expire ...
War's user avatar
  • 113
4 votes
3 answers
3k views

How does "your new password must differ at least n characters from the previous" work when only hash codes are stored?

I am wondering how the password policy "your new password must differ at least n characters from your old password" works. My understanding is that the OS never actually stores the old passwords ...
Honza Zidek's user avatar
0 votes
1 answer
634 views

OpenLdap 2.4.40 Password Control implementation

I have configuration problem with new openldap server . I successfully set the password policy on the server and I setted up the overlay settings also , It work well , my only problem is the Password ...
CsharpJoe's user avatar
  • 101
2 votes
1 answer
8k views

Openldap setting up olcOverlay: ppolicy

Question: Why am I failing to add the objectclass pwdPolicy to cn=PasswordDefaults? Background Information I am new to LDAP and I'm stumbling through various tutorials and other tips online to ...
hededo's user avatar
  • 65
2 votes
1 answer
1k views

OpenLDAP password policy for a group

Just wondering if OpenLDAP is able to assign a password policy to a specific group? Thanks
Ke Wang's user avatar
  • 23
1 vote
1 answer
82 views

How to increase time for password-protected screensaver

I run a network with server 2012 r2, I have users in active directory. The computers lock after 5 minutes of inactivity. Is there any way to extend the time to 1 hour?
New to Server 2016's user avatar
4 votes
1 answer
7k views

The password on this account cannot be changed at this time?

A user in my company forgot his password and I had to reset it to a temporary one. I checked the box that says "User Must Change Password at Next Logon". When he logged on and entered the temporary ...
Daniel's user avatar
  • 7,049
-2 votes
1 answer
379 views

Active directory 2012 password policy

I have a windows server 2012 R2 active directory environment running in my office. I have a primary domain and a child domain. Both the domains have password complexity enabled. Active directory ...
jack's user avatar
  • 21
-1 votes
1 answer
2k views

Openldap Password change at first login

I have implemented openldap in centos 6, I want to push password change policy at first login. Which pwdPolicy ObjectClass and Attributes can accomplish this task ? # MyOrgPPolicy, Policies, ...
Vishesh Sayal's user avatar
5 votes
3 answers
2k views

Block RSA authentication when password is expired

I'm setting up a FreeIPA server on CentOS 7, and I want to block RSA authentication over SSH when the password is expired. By default, when I expire the user password and they login, they are forced ...
sKr0d's user avatar
  • 51
0 votes
1 answer
481 views

Applied DISA STIGs for Windows 7, locked out all accounts, how to get back into the box?

I see the response below, which I appreciate it, but I do not feel it qualifies as an answer. It states little more than, "You shouldn't have done that", but doesn't provide any suggested solutions, ...
Geundy's user avatar
  • 1
5 votes
3 answers
44k views

Unable to update the password. The value provided for the new password does not meet the length, complexity, or history requirements of the domain

I'm using federated identity for Office-365 single sign-on. I have added the password change endpoint to my ADFS 3.0 server, and successfully opened the adfs update password page. However, whenever I ...
user3340627's user avatar
3 votes
1 answer
139 views

How convince Security auditors to change frequent password change policy?

I am a new Junior IT Manager in a small company of around 500 employees and the current policy regarding passwords has enforced password expiration within 30 days, with a password history of 5. As ...
Dumraden's user avatar
1 vote
1 answer
2k views

Why isn't pwdReset automatically set when pwdMustChange is true?

Every other directory server, i.e. Oracle's will automatically set pwdReset to TRUE if pwdMustChange is defined in the policy: When a user's password is changed by another user, such as a password ...
user326892's user avatar
2 votes
2 answers
2k views

Force user to change AD password at logon before Explorer loads?

Background: In our environment, users log onto a Windows 7 PC and then launch a full-screen Citrix XenApp (same as Microsoft RDSH) desktop. Citrix Reciever with single-sign on is used to launch the ...
AdamR's user avatar
  • 51
4 votes
3 answers
17k views

Enforce 15-character minimum password length on Windows

I've been given a requirement to enforce a minimum password length of 15 characters on my Windows-based systems. Supposedly, this is possible and is being done on some other systems already. However, ...
Iszi's user avatar
  • 2,456
2 votes
1 answer
1k views

Reversible Encryption - Not Defined but Showing as Enabled?

I'm reviewing our complex password policy that was setup by a previous admin and I'm trying to gain some clarification on the setting for Reversible Encryption. In our organization, reversible ...
Dave's user avatar
  • 23
0 votes
1 answer
649 views

Cannot load compiled ltb-password-check module on Debian

I'm trying to compile and load LDAP Tool Box Project's password checker module to improve the capabilities of password policy overlay on the Debian 7.8. Here's what I've done so far: I've installed ...
bayindirh's user avatar
  • 694
0 votes
2 answers
2k views

Cannot change password policy

I am logged in as the administrator in my Windows Server 2008 computer which is a domain controller. The password policies in local security policy are grey and I cannot change them. Do I have to ...
Ant Gar's user avatar
  • 19
3 votes
5 answers
19k views

Apply a password group policy seperate from the Default Domain Policy?

Im trying to keep my Default Domain Policy clean and standard and I want to make a GPO for my password policies. I made it but it still gets the policies from the Default Domain Policy object. I ...
riahc3's user avatar
  • 515
1 vote
1 answer
1k views

Cannot enforce password change in OpenLDAP with Password Policy Overlay

I've implemented Password Policy Overlay on OpenLDAP on Debian Stable. The server side and the policies are working as expected. However, after expiration I cannot force users to change their ...
bayindirh's user avatar
  • 694
3 votes
1 answer
1k views

Forcing a password change on OpenBSD

On OpenBSD 5.6 I need to provision a number of user accounts with default passwords. I would like users, upon their first SSH login, to be forced to change their passwords from the default. On CentOS ...
J.C.'s user avatar
  • 131
4 votes
2 answers
6k views

Workstations hang on "Change Password" after expired Password

For one of our customers we have configered a maximum password age of 90 days. If those 90 days are over, the users are forced on logon to change their password. This worked fine for the past 9 months,...
SaintCore's user avatar
3 votes
1 answer
11k views

Get password policy information from LDAP Server

Is there a way to get the password policy information (password length, complexity etc) of a user from an OpenLDAP server? (with ldapsearch or some other way).
Cobra Kai Dojo's user avatar