• State Verified Answer
  • Locked Locked
  • Replies 5 replies
  • Subscribers 62 subscribers
  • Views 7991 views
  • Users 0 members are here
Options
Related
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

How can I deny admins the right to reset their own password?

michael.short
over 5 years ago

I have a bunch of users who have (quite properly) the ability to reset passwords.  Unfortunately, a number of them are abusing this ability by resetting (rather than changing) their own passwords so that they keep the same password in spite of the password policies.

These users are members of a specific group.  Is there a way that I can  deny them the right to reset only their own password?  I don't want to block them from being able to reset their colleagues passwords, just their own.

Thanks,

Mike...

Parents
  • 0 over 5 years ago

    There is a *native* flag you can set on the user for this: "User cannot change password".  This prevents a user from changing their own password.  Though preventing users from changing their own passwords is a potential security problem isn't it?  i.e. unless you do a lot of auditing, how will you know When someone else (i.e. another admin) changing an admin's password is legitimate?

    Within AR, you could also set a deny access template for NTAuthority\Self for the reset password permission.

Reply
  • 0 over 5 years ago

    There is a *native* flag you can set on the user for this: "User cannot change password".  This prevents a user from changing their own password.  Though preventing users from changing their own passwords is a potential security problem isn't it?  i.e. unless you do a lot of auditing, how will you know When someone else (i.e. another admin) changing an admin's password is legitimate?

    Within AR, you could also set a deny access template for NTAuthority\Self for the reset password permission.

Children
No Data