Password Manager 5.8.2 - Administrator Guide (AD LDS edition)

By using this user enforcement rule you can configure Password Manager to invite users to register with Password Manager or update their Questions and Answers profiles. If you configure this enforcement rule, users will be notified by email.

The notification schedule is defined by the Invitation to Create/Update Profile scheduled task. Note that notification starts only after this scheduled task has run. For more information on the scheduled tasks, see Invitation to Create/Update Profile Task.

IMPORTANT: If you disable the Invitation to Create/Update Q&A Profile scheduled task, users will not be enforced to create or update their profiles.

This enforcement rule is disabled by default. To enable the rule, on the Home page of the Administration site, expand the required enforcement rules section, click Invite Users to Create/Update Q&A Profiles, and then click Enable.

To configure this enforcement rule, you must specify a user scope, conditions when an email notification should be sent and an email notification text.

To configure this enforcement rule

Connect to the Administration site by typing the Administration site URL in the address bar of your Web browser. By default, the URL is http://<ComputerName>/PMAdminADLDS/.
Select the Management Policy you want to modify.
Expand the Enforcement Rules section and click Invite Users to Create/Update Profiles.
To set the user scope of this rule, click Configure under Configure the rule’s scope, specify the following settings and click Save:

Table 9: Configure scope of rule
Option	Description
Users from the user scope of the Management Policy	Select this option to include all users from the Management Policy user scope to the enforcement rule scope.
The following users	Select this option to specify groups included to and excluded from the enforcement rule scope.
Users included both in the Management Policy user scope and the following groups	Specify groups included in the enforcement rule scope. Note, that only users belonging both to the Management Policy user scope and the specified groups will be included in the enforcement rule scope. To browse for groups, click Add, select the required groups and click Save.
Users excluded from the rule’s scope	Specify groups excluded from the enforcement rule scope. To browse for groups, click Add, select the required groups and click Save.

To specify the conditions under which users should be notified to create or update their Q&A profiles, click Configure under Notify users who meet the following condition, select one or more of the following options and click OK:

Table 10: User notifications
Option	Description
User is not registered with Password Manager	Select to force users to register with Password Manager by creating Q&A profiles, if users are not registered with Password Manager.
The question user answered to register was modified or deleted	Select to have users update their Q&A profiles if one or more questions which users answered to register were modified or deleted.
User's Q&A profile contains fewer questions than required for registration	Select to have users update their Q&A profiles if you have added one or more questions required for registration, thus making the list of such questions longer than it was before users’ profiles were last updated.
User’s answers are shorter than required	Select to have users update their Q&A profiles if any of users' answers contain fewer characters than the current settings require.
User-defined questions are shorter than required	Select to have users update their Q&A profiles if any of the user-defined questions contain fewer characters than the current settings require.
User has specified the same answer for several questions	Select to have users update their Q&A profiles if Q&A profiles contain the same answer for different questions if the current settings specify the opposite.
Settings for encrypting user's answers have been changed since Q&A profile creation	Select to have users update their Q&A profiles if the current encryption setting (defined by the Store answers using reversible encryption option in the Q&A profile settings) has been changed since Q&A profile creation. For example, when users created their profiles, the option was disabled, and later the option became enabled, and vice versa.
The question list users answered to create Q&A profile was removed or disabled	Select to have users update their Q&A profiles if the question list they used when registering was deleted or disabled. For example, if the question list in a particular language was deleted.

To edit the notification template, use a WYSIWYG editor in the Configure email notification section.
To define the default notification language, click the language link next to the Default language option and select the required language.
To specify the notification text in another language, click Add new language and select the required language. Notification templates in 17 languages are available out of the box (English, Chinese (Simplified), Chinese (Traditional), Danish, Dutch, French, German, Italian, Japanese, Korean, Portuguese (Brazil), Portuguese (Portugal), Russian, Spanish, Polish, Czech, Swedish). The language of the notification message corresponds to the language of a user’s Q&A profile. If the corresponding language is not available, the notification message is sent in the default language.
To specify the daily number of new users who will be invited to create or update their Q&A profiles, enter the number in the Set the daily number of users to be invited spin box. Use this option to reduce server load and enhance performance.
Click Save.

IMPORTANT: To send email notifications to users, you must specify an outgoing mail server (SMTP server). For more information on how to configure the SMTP server, seeOutgoing Mail Servers.

Remind Users to Create/Update Q&A Profiles

Management Policies > User Enforcement Rules > Remind Users to Create/Update Q&A Profiles

Remind Users to Create/Update Profiles

By using this enforcement rule, you can configure Password Manager to remind users to create or update their Q&A profiles. If you configure this enforcement rule, users will be notified by email.

For this enforcement rule you can configure multiple notification scenarios depending on the invitation date.

The notification is performed by the Reminder to Create/Update Profile scheduled task. Note that email notification starts only after this scheduled task has run. For more information on the scheduled tasks, see Reminder to Create/Update Profile Task.

IMPORTANT: To notify users by email, the Reminder to Create/Update Q&A Profile scheduled task should be enabled.

This enforcement rule is disabled by default. To enable the rule, on the Home page of the Administration site, expand the required enforcement rules section, click Remind Users to Create/Update Q&A Profiles, and then click Enable.

To configure this enforcement rule, you must specify a user scope and notification scenarios.

To configure the enforcement rule user scope

Connect to the Administration site by typing the Administration site URL in the address bar of your Web browser. By default, the URL is http://<ComputerName>/PMAdminADLDS/.
Select the Management Policy you want to modify.
Expand the Enforcement Rules section and click Remind Users to Create/Update Q&A Profiles.
To set the user scope of this rule, click Configure under Configure the rule’s scope, specify the following settings and click Save:

Table 11: Configure the scope of the rule
Option	Description
Users from the user scope of the Management Policy	Select this option to include all users from the Management Policy user scope to the enforcement rule scope.
The following users	Select this option to specify groups included to and excluded from the enforcement rule scope.
Users included both in the Management Policy user scope and the following groups	Specify groups included in the enforcement rule scope. Note, that only users belonging both to the Management Policy user scope and the specified groups will be included in the enforcement rule scope. To browse for groups, click Add, select the required groups and click Save.
Users excluded from the rule’s scope	Specify groups excluded from the enforcement rule scope. To browse for groups, click Add, select the required groups and click Save.

To configure notification scenarios

Connect to the Administration site by typing the Administration site URL in the address bar of your Web browser. By default, the URL is http://<ComputerName>/PMAdminADLDS/.
Select the Management Policy you want to modify.
Expand the Enforcement Rules section and click Remind Users to Create/Update Q&A Profiles.
To add a new notification scenario, click Add, or to modify an existing notification scenario click Edit in the Apply the following notification scenarios to users from the rule’s scope section.
In the User was invited to create/update Q&A profile N days ago option, enter the required number of days to apply this enforcement rule to users who were invited to register with Password Manager or update their Q&A profiles the specified number of days ago. Click Next.
Edit the email notification template if necessary. Specify the following settings if required and click OK:
- To define the default notification language, click the language link next to the Default language option and select the required language.
- To specify the notification text in another language, click Add new language and select the required language. Notification templates in 17 languages are available out of the box (English, Chinese (Simplified), Chinese (Traditional), Danish, Dutch, French, German, Italian, Japanese, Korean, Portuguese (Brazil), Portuguese (Portugal), Russian, Spanish, Polish, Czech, Swedish).
IMPORTANT: To send email notifications to users, you must specify an outgoing mail server (SMTP server). For more information on how to configure the SMTP server, see Outgoing Mail Servers.

Remind Users to Change Password

Management Policies > User Enforcement Rules > Remind Users to Change Password

By using this enforcement rule you can configure Password Manager to notify users about password expiration. If you configure this notification, users will be notified by email.

The notification schedule is defined by the Reminder to Change Password scheduled task. Note that notification starts only after this scheduled task has run. For more information on the scheduled tasks, see Reminder to Change Password Task.

IMPORTANT: If you disable the Reminder to Change Password scheduled task, users will not be reminded of password expiration.

To enable the rule, on the Home page of the Administration site, expand the required enforcement rules section, click Remind Users to Change Password, and then click Enable.

To configure this enforcement rule, you must specify a user scope, conditions when an email notification should be sent and an email notification text.

To configure this rule

Connect to the Administration site by typing the Administration site URL in the address bar of your Web browser. By default, the URL is http://<ComputerName>/PMAdminADLDS/.
Select the Management Policy you want to modify.
Expand the Enforcement Rules section and click Remind Users to Change Password.
To set the user scope of this rule, click Configure under Configure the rule’s scope, specify the following settings and click Save:

Table 12: Configure the scope of rule
Option	Description
Users from the user scope of the Management Policy	Select this option to include all users from the Management Policy user scope to the rule’s scope.
The following users	Select this option to specify groups included to and excluded from the rule’s scope.
Users included both in the Management Policy user scope and the following groups	Specify groups included in the rule’s scope. Note, that only users belonging both to the Management Policy user scope and the specified groups will be included in the rule’s scope. To browse for groups, click Add, select the required groups and click Save.
Users excluded from the rule’s scope	Specify groups excluded from the rule’s scope. To browse for groups, click Add, select the required groups and click Save.

To specify the conditions under which users should be notified to change their passwords, click Configure under Notify users who meet the following condition, specify the number of days before password expiration and click OK.
To edit the notification template, use a WYSIWYG editor in the Configure email notification section.
To define the default notification language, click the language link next to the Default language option and select the required language.
To specify the notification text in another language, click Add new language and select the required language. Notification templates in 17 languages are available out of the box (English, Chinese (Simplified), Chinese (Traditional), Danish, Dutch, French, German, Italian, Japanese, Korean, Portuguese (Brazil), Portuguese (Portugal), Russian, Spanish, Polish, Czech, Swedish). The language of the notification message corresponds to the language of a user’s Q&A profile. If the corresponding language is not available, the notification message is sent in the default language.
Click Save.

IMPORTANT: To send email notifications to users, you must specify an outgoing mail server (SMTP server). For more information on how to configure the SMTP server, see Outgoing Mail Servers.