Password expiry annoyance

[Badaz52]

Hi everyone,

 

We have been having this problem for a long time now and with staff using credential manager it is causing a real pain. Basically staff passwords expire every 90 days and they use roaming profiles, although they get the warnings to change their password which don't always appear for some reason we have this annoying issue that means they can logon and use the system and then bang it will expire. Smoothwall proxy boxes pop up for authentication, office 365 stops working etc. If they log out and back in it will say their password has expired and force them to change it.

 

The credential manager thing is irrating too because for some reason they type in everything BUT their school username into the username field and then this saves it to credential manager so even after they have changed it, office 365 won't be happy and smoothwall won't be either until the entry is removed from credential manager.

 

I did disable credential manager which removed one issue but several staff in the office kicked off so I had to put it back.

 

This issue for us at least has been around since we had Windows 7, XP was never a problem it just wouldn't let them login at all if their password had expired.

 

Is this is a bug or is there a simple Group Policy that I have missed?

 

Cheers!

[ADMaster]

The balloon notification is too easy to miss. I liked XP where it said it would expire in X days before you got the desktop.

To help users know their password is expiring, I wrote a script that emails them Monday – Friday of the 7 days before it expires.

The email explains to them how to change their password from a school computer or from home through email.

I also explain what they will lose access to when it expires such as shares, printers and wireless.

 

I wrote this mainly to head off the flood of tickets every February. Our policy is 180 days so 6 months after school starts I get flooded with I can’t print tickets.

 

 

The root cause is people not properly logging off to get the notification, or those who log on at home with cached credentials.

[Boredguy]

We have a Powershell script that checks each morning the last changed date of the staff accounts password in AD, and if it's due to expire either during a holiday, or within X days it e-mails them to remind them to change it.

[RLR]

We have a Powershell script that checks each morning the last changed date of the staff accounts password in AD, and if it's due to expire either during a holiday, or within X days it e-mails them to remind them to change it.

 

Yes, we have the same. Reminds them every day for 20 days to reset their password.

[maark]

Advice is not to enforce change now? https://www.ncsc.gov.uk/articles/problems-forcing-regular-password-expiry