AD Password Change

[veste]

Hello Experts!

We use secureclient and securemote (R60-hfa02, win-xp clients) with radius-authentication towards our active directory (IAS on W2K) and it works well.

We have one problem : if a password is about to expire, the SR/SC asks to change the password. When the user does so, the domain-pw is changed, but only on the DC. The old password is cached on the client side, so there's a mixture old pw - new pw -- very confusing for the users!

Is it possible to disable this behaviour in secureclient/securemote (no pw-change)?


regards,
stefan

[chillyjim]

Are you using SDL? If you do, then the client will have a connection to the DC and will receive the new password. Otherwise all bets are off as to when the client decides to update the cached credentials.

[ppawlo]

Originally Posted by veste

Hello Experts!

We use secureclient and securemote (R60-hfa02, win-xp clients) with radius-authentication towards our active directory (IAS on W2K) and it works well.

We have one problem : if a password is about to expire, the SR/SC asks to change the password. When the user does so, the domain-pw is changed, but only on the DC. The old password is cached on the client side, so there's a mixture old pw - new pw -- very confusing for the users!

Is it possible to disable this behaviour in secureclient/securemote (no pw-change)?


regards,
stefan

Do you have SP2 for Windows XP?
I think after that you should put (ctrl+alt+del) block computer, and unblock. Then the system should know new password.

Pawel

[chillyjim]

The whole process is documented here http://www.cpug.org/check_point_reso...0FW-1%20NG.zip

It's a little dated but you will get the idea.

[veste]

Originally Posted by ppawlo

Do you have SP2 for Windows XP?
I think after that you should put (ctrl+alt+del) block computer, and unblock. Then the system should know new password.

Pawel

Originally Posted by chillyjim

Are you using SDL? If you do, then the client will have a connection to the DC and will receive the new password. Otherwise all bets are off as to when the client decides to update the cached credentials.

No i don't use SDL and yes XP-SP2 is installed on all clients!
I read all the documents. I don't use smart directory as we only have an "express"-license, so they don't match exactly our environment.

I've quick-tried the (ctrl+alt+del)-trick and it seems to work - more a workaround than a solution, but for now better than nothing.


regards,
stefan

[chillyjim]

Enable SDL then the passwords will stay in sync as the connection to the DC will be up before you change your password.