Chat now with support
Chat with Support

Identity Manager 8.0.1 - Administration Guide for Connecting to Active Directory

Managing Active Directory Environments Setting up Active Directory Synchronization Base Data for Managing Active Directory Active Directory Domains Active Directory User Accounts Active Directory Contacts Active Directory groups Active Directory Security IDs Active Directory Container Structures Active Directory computer Active Directory Printers Active Directory Locations Reports about Active Directory Objects Appendix: Configuration Parameters for Managing Active Directory Appendix: Default Project Template for Active Directory Appendix: Authentication Modules for Logging into the One Identity Manager

Entering Active Directory Account Policies

Entering Active Directory Account Policies

Account policies are loaded into the One Identity Manager database during synchronization. You have the option to edit existing account policies and add new ones.

To enter master data for an account policy

  1. Select the category Active Directory | Account policies.
  2. Select an account policy in the result list and run the task Change master data.

    - OR -

    Click New in the result list toolbar.

  3. Edit the account policy's master data.
  4. Save the changes.
Detailed information about this topic

General Master Data for an Active Directory Account Policy

General Master Data for an Active Directory Account Policy

Enter the following data on the General tab:

Table 35: General Master Data for an Account Policy
Property Description

Name

Account policy name

Domain

Active Directory domain for which the account policy is available.

Distinguished name

Distinguished name of the account policy. The distinguished name made up from the account policy name, the system container for password policies "Password Settings Container" and the domain.

Display name

Display name to display in the One Identity Manager tools.

Simple display

Display name for systems that cannot interpret all the characters of normal display names.

Description

Spare text box for additional explanation.

Related Topics

How to Define a Policy

Enter the following master data on the Policies tab.

Table 36: Master Data for a Policy Definition
Property Description

Block duration [min]

Block duration in minutes. Enter the time period the account should be locked for before it is automatically reset.

Reset account [min]

Duration in minutes of account reset. Enter the time period that can elapse between two invalid attempts to enter a password before a user account is locked.

Max. errors

Maximum number of errors. Set the number of invalid passwords. If the user has reached this number the user account is blocked.

Max. password age

Maximum age of the password. Enter the length of time a password can be used before it expires.

Min. password age

Minimum age of the password. Enter the length of time a password has to be used before the user is allowed to change it.

Min. password length

Minimum length of the password. Use this option to specify that a password has to be complex.

Password history

Enter the number of passwords to be saved. If the value '5' is entered, for example, the last 5 passwords of the user are saved.

Ranking

Ranking for password settings. If several account polices are assigned to a user account or a group, the account policy is used that has the lowest value.

Complex passwords

Specifies how complicated the password should be. Complex passwords must fulfill certain minimum prerequisites. For more information, see the documentation for implementing Windows Server.

Save passwords with reversible encryption

Details for encrypting passwords. By default, passwords that are saved in Active Directory are encrypted. When you use this option, passwords are saved in plain text and can be restored again.

Related Topics

Assigning Active Directory Account Policies to Active Directory User Accounts and Active Directory Groups

Assigning Active Directory Account Policies to Active Directory User Accounts and Active Directory Groups

If several account policies are assigned to one user account, the actual account policy is found using specific rules. If there are no special account policy the domain setting apply. Please refer to your Windows Server documentation on fine-grained account policies under Active Directory for information about the rules for calculating this.

To specify account policies for a user account

  1. Select the category Active Directory | Account policies.
  2. Select the account policy in the result list.
  3. Select Assign user accounts in the task view.
  4. Assign user accounts in Add assignments.

    The view- OR -

    Remove user accounts from Remove assignments.

  5. Save the changes.

To specify account policies for a group

  1. Select the category Active Directory | Account policies.
  2. Select the account policy in the result list.
  3. Select Assign groups in the task view.
  4. Assign groups in Add assignments.

    The view- OR -

    Remove groups from Remove assignments.

  5. Save the changes.
Related Documents