Password Manager 5.9.5 - How to Guide

Manage My Profile

The Manage My Profile workflow allows the administrator to manage user profiles in Active Directory by using the Admin site. Manage My Profile uses settings of Register workflow.

Use this workflow only if the user's Questions and Answers profile is pending for update. To configure, do the following:

1. Select Manage My Profile activity.
2. Click Settings.
3. Select the check box Run this activity only if user's profile should be updated.

Edit Q&A Profile

Edit Q&A Profile

This activity is a part of the Register and Manage My Profile workflow. Use this activity to allow users to create and update their Questions and Answers profiles.

You can also use this activity in the Forgot My Password and Unlock My Account workflows, if you want to force users to update their Q&A profiles after they reset passwords or unlock their accounts. When you use this activity in the Forgot My Password and Unlock My Account workflows, select the Run this activity only if user’s Q&A profile should be updated check box to make users update their Q&A profiles only if the profiles are not compliant with the current requirements.

When you use Run this activity only if user’s profile should be updated activity in workflows other than Register and Manage My Profile, for example, in Forgot My Password and Unlock My Account workflows, select this check box to make users update their Q&A profiles only if the profiles are not compliant with the current Q&A policy.

Reset Password in Active Directory

Reset Password in Active Directory

This is a core activity of the Forgot My Password workflow. The activity allows users to reset passwords in Active Directory only. If you want to enable users to reset passwords in several systems, configure the Reset password in Active Directory and connected systems, Reset password in connected systems through embedded connectors(Preview) activity. For more information on configuring this activity and using One Identity Quick Connect Sync Engine, see Reset Password in Active Directory and Connected Systems.

In this activity you can configure the Enforce password history option. Password history determines the number of unique new passwords that have to be associated with a user account before an old password can be reused. Password history is defined for a domain through Group Policy settings.

Before selecting this option, you should consider the following by-design behavior of Password Manager when that the Enforce password history option is enabled:

• Password Manager uses two slots from the password history every time a password is reset. For example, if the password history value defines that users cannot reuse any of the last 10 passwords, then Password Manager checks only the last five passwords. Therefore, it is advised that you double the password history value for all managed domains.
• Having entered a new password that is not policy compliant, users may end up with a randomly generated password they don't know.

The Use auto generated password option enables Helpdesk users to generate a new password during password reset process.

The Use manual password option enables Helpdesk users to reset the password manually.

The Send password using Starling push notification option enables HelpDesk users to send the password using a push notification to their mobile devices to reset password.

The Enable QESSO integration option allows you to integrate Password Manager with Quest Enterprise Single Sign-On (QESSO) and notify QESSO about user’s password changes. For more information, see Quest Enterprise Single Sign-On (QESSO).

Select the Allow users to reset passwords offline option to enable users to use the offline password reset functionality provided by Password Manager. This functionality allows resetting passwords when users have forgotten their current passwords and their computers are not connected to the intranet (Active Directory is not available).

This functionality is based on resetting user password in locally cached logon data. The security is provided by using the challenge-response mechanism that guarantees the following:

• A user can reset the locally cached password only after resetting the password online on the Self-Service site.
• A user must specify the same password on the Self-Service site and on the computer in the Offline Password Reset wizard.

When offline password reset is enabled on users’ computers, a user must perform the following steps to reset his or her password:

1. Open the Offline Password Reset wizard by clicking the corresponding link on the Windows login screen.
2. In the wizard, enter the user name (this step is optional). Click Next.
3. Open the Self-Service site on a computer connected to the internet and find their account.
4. Select the corresponding task to reset password.
5. When performing the task, the user must specify a new password. When the task is successfully performed, a response code is displayed for the user.
6. Then, in the Offline Password Reset wizard, the user must enter the response code and the new password the user specified on the Self-Service site. Click Next.
7. If the password is successfully reset, click Finish to close the wizard.

Enabling the offline password reset functionality

1. Install the offline password reset component on target user computers via group policy. Use the OfflinePasswordReset_x64.msi or OfflinePasswordReset_x86.msi files located in the \Password Manager\Setup folder on the installation CD.

Note that Secure Password Extension must be installed on target user computers, as well. For more information on installing Secure Password Extension, see Deploying and Configuring Secure Password Extension.

2. Set the required number of cached user login attempts. This is necessary because the offline password reset functionality will be available only for users who have previously logged in on their computers. You can use this Microsoft knowledge base article, http://support.microsoft.com/kb/172931 to change the number of cached login attempts. It is recommended to use the default value.
3. Use the administrative template prm_gina.admx to turn on the offline password reset functionality. The administrative template file is located in the \Password Manager\Setup\Template\Administrative Template\ folder of the installation CD. In the template, enable the following settings: Display the Offline Password Reset button (command link) and Set custom name for the Offline Password Reset button (command link) in <Language>. For more information on using the administrative template, see Managing Secure Password Extension UsingAdministrative Templates.
4. Use the Reset password in Active Directory activity in a required workflow and select the Allow users to reset passwords offline option.
5. Save the workflow.

To provide authentication during the offline password reset procedure, a shared secret is used. The shared secret is stored locally on a user computer and its copy is published in Active Directory in the computer’s account during the first login if the computer is connected to the domain. By default, only domain administrators and the computer account have access to the shared secret. You can specify other users and groups who will have the permission to read the shared secret from the domain. To do it, use the Configure scope for accessing the shared secret in Active Directory setting in the administrative template. For more information on the administrative template, see Managing Secure Password Extension UsingAdministrative Templates.

You can also use the Shared secret update period (hours) setting in the administrative template to specify how often the shared secret should be updated. The recommended value is every 24 hours. For more information on the administrative template, see Managing Secure Password Extension UsingAdministrative Templates.

Change Password in Active Directory

Change Password in Active Directory

This is a core activity of the Manage My Passwords workflow. The activity allows users to change passwords in Active Directory only. If you want to enable users to change passwords in several systems, configure the Change password in Active Directory and connected systems activity. For more information on configuring this activity and using One Identity Quick Connect Sync Engine, see Change Password in Active Directory and Connected Systems.

Run this activity only when user must change password at next logon Select this check box when you use this activity in workflows other than Manage My Passwords. By using this option, you can force users who are required to change password at next login to change password while performing other tasks on the Self-Service site.

For example, if you add the Change password in Active Directory activity with this option selected to the Manage My Profile workflow, you will force users who are required to change password at next logon to change password when creating or updating their Q&A profiles.

The Enable QESSO integration option allows you to integrate Password Manager with Quest Enterprise Single Sign-On (QESSO) and notify QESSO about user’s password changes. For more information, see Quest Enterprise Single Sign-On (QESSO).