Chat now with support
Chat with Support

Password Manager 5.13.0 - Administration Guide

About Password Manager Getting Started Password Manager Architecture
Password Manager Components and Third-Party Solutions Typical Deployment Scenarios Password Manager in Perimeter Network Management Policy Overview Password Policy Overview Secure Password Extension Overview reCAPTCHA Overview User Enrollment Process Overview Questions and Answers Policy Overview Password Change and Reset Process Overview Data Replication Phone-Based Authentication Service Overview
Management Policies
Checklist: Configuring Password Manager Understanding Management Policies Configuring Access to the Administration Site Configuring Access to the Self-Service Site Configuring Access to the Helpdesk Site Configuring Questions and Answers Policy Workflow overview Custom workflows Custom Activities Self-Service Workflows Helpdesk Workflows Notification Activities User Enforcement Rules
General Settings
General Settings Overview Search and Logon Options Import/Export Configuration Settings Outgoing Mail Servers Diagnostic Logging Scheduled Tasks Web Interface Customization Instance Reinitialization Realm Instances Domain Connections Extensibility Features RADIUS Two-Factor Authentication Internal Feedback Password Manager components and third-party applications Unregistering users from Password Manager Bulk Force Password Reset Fido2 key management Working with Redistributable Secret Management account Email Templates
Upgrading Password Manager Administrative Templates Secure Password Extension Password Policies Enable S2FA for Administrators & Enable S2FA for HelpDesk Users Reporting Password Manager Integration Accounts Used in Password Manager Open Communication Ports for Password Manager Customization Options Overview Feature imparities between the legacy and the new Self-Service Sites Glossary

Password Policies

About Password Policies

You can use Password Manager to create password policies that define which passwords to reject or accept. Password policy settings are stored in Group Policy objects (GPOs). A GPO is applied by linking the GPOs to a target container defined in Active Directory, such an organizational unit or a group.

Group Policy objects from parent containers are inherited by default. When multiple Group Policy objects are applied, the policy settings are aggregated.

For information on how to apply a password policy and change policy link order, see Managing Password Policy Scope.

Password Policy Manager

Password Policy Manager is an independently deployed component of Password Manager. Password Policy Manager is required to enforce Password Manager password policies when users change their passwords using tools other than Password Manager. To enforce Password Manager password policies, you must deploy Password Policy Manager on all Domain Controllers (DC) of your managed domain.

When a user changes their password in Password Manager, the new password is checked right away. If it complies with password policies configured in Password Manager, the new password is accepted.

However, when a user changes their password outside of Password Manager (for example, within the operating system by pressing Ctrl+Alt+Delete), Password Manager can not check the new password immediately. Instead, the compliance of the new password to the password policy rules is checked on a DC of the managed domain where Password Policy Manager is installed. If PPM is not installed on the DCs of the managed domain, then new passwords set outside Password Manager will not be checked against the password policies configured in Password Manager.

As such, Password Policy Manager extends the default password policy settings and allows administrators to configure policy scopes for each policy, so that only specified organizational units and groups are affected by the policy.

Password policy settings are stored as Group Policy Objects (GPOs). Password Policy Manager can only create new GPOs: it does not change any existing GPOs.

The installer of the Password Policy Manager component is located at the following subfolder of the Password Manager ISO image or extracted installation archive:

/Password Manager/Setup/PasswordPolicyManager_x64.msi

Password Policy Rules

Password Manager uses a set of powerful and flexible rules to define requirements for domain passwords. Each password policy has rules that are configured independently of the rules in other policies.

The following rules duplicate and extend system password policy rules: Password Age rule, Length rule, Complexity rule, and User Properties rule.

For information on how to create and configure a password policy, see Creating and Configuring a Password Policy.

To display the properties of a password policy

  1. On the home page of the Administration site, click the Password Policies tab.
  2. Click the <N> One Identity Password Policieslink under the domain that you want to manage.
  3. On the One Identity Password Policiesfor Domain<DomainName> page, click Edit under the policy whose properties you want to view or modify.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating