General main data for an Active Directory account policy
Enter the following data on the General tab.
Table 27: General main data of an account policy
Name |
Account policy name |
Domain |
Active Directory domain for which the account policy is available. |
Distinguished name |
Distinguished name of the account policy. The distinguished name is formed based on rules and is made up of the name of the account policy, the system container for password policies Password Settings Container, and the domain. |
Display name |
Display name to display in the One Identity Manager tools. |
Simple display |
Display name for systems that cannot interpret all the characters of normal display names. |
Description |
Text field for additional explanation. |
Related topics
Guidelines for Active Directory account guidelines
Enter the following main data on the Policies tab.
Table 28: Main data for a policy definition
Block duration [min] |
Block duration in minutes. Enter the time period the account should be locked for before it is automatically reset. |
Reset account [min] |
Duration in minutes of account reset. Enter the time period that can elapse between two invalid attempts to enter a password before a user account is locked. |
Max. errors |
Maximum number of errors. Set the number of invalid passwords. If the user has reached this number the user account is blocked. |
Max. password age |
Maximum age of the password. Enter the length of time a password can be used before it expires. |
Minimum password lifetime |
Minimum age of the password. Enter the length of time a password has to be used before the user is allowed to change it. |
Minimum password length |
Minimum length of the password. Use this option to specify that a password has to be complex. |
Password history |
Enter the number of passwords to be saved. For example, if you enter the value 5, the last 5 passwords for the user are saved. |
Ranking |
Ranking for password settings. If several account polices are assigned to a user account or a group, the account policy is used that has the lowest value. |
Complex passwords |
Specifies how complicated the password has to be. Complex passwords must fulfill certain minimum prerequisites. For more information, see the documentation for implementing Windows Server. |
Save passwords with reversible encryption |
Details for encrypting passwords. By default, passwords that are saved in Active Directory are encrypted. When you use this option, passwords are saved in plain text and can be restored again. |
Related topics
Assigning Active Directory account policies to Active Directory user account and Active Directory groups
If several account policies are assigned to one user account, the actual account policy is found using specific rules. If there are no special account policy the domain setting apply. Refer to the concept of fine-grained password guidelines under Active Directory in the documentation for your Windows Server for information about the calculation rules.
To specify account policies for user accounts
-
In the Manager, select the Active Directory > Account policies category.
-
Select the account policy in the result list.
-
Select in the Assign user accounts task.
-
In the Add assignments pane, assign the user accounts.
TIP: In the Remove assignments pane, you can remove assigned user accounts.
To remove an assignment
- Save the changes.
To specify account policies for groups
-
In the Manager, select the Active Directory > Account policies category.
-
Select the account policy in the result list.
-
Select the Assign groups task.
-
In the Add assignments pane, assign the groups.
TIP: In the Remove assignments pane, you can remove the assignment of groups.
To remove an assignment
- Save the changes.
Editing the synchronization project for an Active Directory domain
Synchronization projects in which a domain is already used as a base object can also be opened in the Manager. You can, for example, check the configuration or view the synchronization log in this mode. The Synchronization Editor is not started with its full functionality. You cannot run certain functions, such as, running synchronization or simulation, starting the target system browser and others.
NOTE: The Manager is locked for editing throughout. To edit objects in the Manager, close the Synchronization Editor.
To open an existing synchronization project in the Synchronization Editor
-
In the Manager, select the Active Directory > Domains category.
-
Select the domain in the result list.
-
Select the Change main data task.
-
Select the Edit synchronization project task.
Related topics