1

I have a situation whereby an AD domain I am working with has a sensible enough password policy in place (e.g., sufficiently high PasswordHistoryCount, MinPasswordLength settings etc.). I can change a given user's password via PowerShell easily enough using the Set-ADAccountPassword cmdlet, like so:

Set-ADAccountPassword
    -Identity "Forename.Surname"
    -NewPassword (ConvertTo-SecureString -AsPlainText "incorrectp0nypetrolnail" -Force)
    -OldPassword (ConvertTo-SecureString -AsPlainText "correcth0rsebatterystaple" -Force)

The above also raises an ADPasswordComplexityException expection when the password policy is violated when attempting to re-use a password, i.e., with the message:

"The password does not meet the length, complexity, or history requirement of the domain."

However, the password history policy is not being enforced when passwords are reset. This occurs either when using the "Active Directory Users and Computers" UI, or when using the Set-ADAccountPassword cmdlet like so (assume the password below has been previously used by the user):

Set-ADAccountPassword
    -Identity "Forename.Surname"
    -Reset
    -NewPassword (ConvertTo-SecureString -AsPlainText "correcth0rsebatterystaple" -Force)

I would have expected the same ADPasswordComplexityException exception to have been raised in this situation.

So - is there any way to prevent a user from reusing passwords when a password reset is made? If not, what are sensible reasons for allowing this?

2

That is the expected behavior and is by design. Administrative resets are not subject to age or history requirements.

| improve this answer | |
  • This being an "administrative reset" is the key point that I'd missed here - thanks! – robyaw Oct 13 '15 at 13:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.