Return
-
Title
HOW TO: Disable password reset in MMC and Web Interface -
Description
In some cases when Password Manager is in use, help desk users are able to bypass password policies by resetting a password manually using the Active Roles Console or Web Interface. -
Cause
When resetting a password using Active Roles, an administrative password reset is performed so the password policies do not come into play, allowing a user to bypass password policies altogether. -
Resolution
Using the Active Roles Console, make a copy of the following built-in access templates, naming and modifying each access template accordingly to be a 'Deny' of the permission:
- Users - Change Password (Extended Right)
- Users - Reset Password (Extended Right)
- Users - Write Password
The above access templates are located in: Configuration | Access Templates | Active Directory | Advanced
The following steps can be used to copy and modify each access template above for 'Deny':
- Right-click the access template and select Copy.
- Provide a name for the new copy of the access template. Ex.: Users - Write Password [DENY]
- Click Next.
- Select the permission in the list and click View/Edit...
- Select the Deny permission check box and click OK.
- Click Next.
- Click Finish.
Once you've copied and denied the permissions in each of the above access templates, use the steps in the Administration Guide, Applying Access Templates, to apply the newly created access templates to the appropriate users or groups.