Share all details about your problem, including any error messages you may have received.
I am trying to make the “Passwords” feature under Manage Accounts Quicklink stop checking the box next to “change password at next login” whenever a password is generated or created OOTB. Screenshots are present. I do not see how to do this in the password policy nor any where in global settings. Please help and assist.
it happend because SP send pwdlastset = 0 with the new password or in case this account is never login, the pwdlastset is already set to 0.
Maybe, in the provising forms(Change Passowrd or Update) of AD applications you a setup to send 0 on this attribute. So, you can remove pwdlastset from forms.
Its possibile you dont find in xml. If you separte prov form, this configuration is on forms.
Check if you have set some forms in Provisioning Policy of app:
Later go to Forms section in Global config and search Update or Change Password form and delete pwdLastSet attribute from it.
Instead, for the creation, this attribute must be present in Create form, set to 0 for to force the change of pwd to the user.
If you set 0 to pwdLastSet, the user must change password. If send a new password, AD changes automatically the value with date of last change
You can change the type to boolean and add the pwdLastSet field to change password provisioning policy. If it is already there, you can change to false.
Please remember, I only want to change it when there is a password reset, not when we are creating a new user and provisioning is completed. is there a way to do that?
This can be more of the self service / admin function were user’s password can be changed by either of them .
When the password is changed by administrator sailpoint will set the pwdLastSet attribute value as 0 by default and thus it will force the user to change the password at next logon.
When the password is changed by user itself , sailpoint will set the pwdLastSet as 0.
To avoid the pwdLastSet being set as 0 when changing the password through admin you can add a before provisioning plan rule, In the rule you can remove preExpire attribute from the attribute request for password change.
if you don’t want to put any logic in change password policy then you can choose @vishal_kejriwal1 suggestions.
in this case, you should be some details in plan like flow = “PasswordRequest” operation=“PasswordChange” ProvisioningPolicies = “ChangePassword” so you can easily identify it’s password change and you can modify the plan in before provisioning policy.
