Return
-
Title
The ARS MMC allows the use of signed-in users with expired passwords under certain conditions. -
Description
The ARS MMC can take longer than 10 minutes to re-authenticate the signed user when their password has been changed. The following conditions must be met for the default re-authentication time interval of 10 minutes to be exceeded:
1.) The Administration Service must be configured to support Kerberos authentication. To enable Kerberos authentication, the Service Principal Name (SPN) of the Active Roles Administration Service must be added to the service account.
setspn -s aradminsvc/<FQDN> <ServiceAccountName>
setspn -s aradminsvc/<name> <ServiceAccountName>
2.) When connecting to the ARS MMC you must connect as an alternate user and not the currently signed in user.
When the password is changed for this alternate user, they can remain signed into the MMC for a few hours before re-authentication occurs, and they are forced to sign in again.
-
Cause
Kerberos authentication can delay the re-authentication time under certain circumstances.
-
Resolution
There is currently no workaround when Kerberos authentication is enabled. Product Defect 168303 has been created regarding this issue. This issue will be resolved in a future release of the Product.