Active Directory Password Synch Agent User Role Differentiation

Products

• CA Identity Manager
• CA Identity Governance
• CA Identity Portal

Issue/Introduction

Organizations utilizing the Identity Manager suite with Active Directory as the authoritative data source often require distinct handling for "password resets" (initiated by an Administrator) versus "password changes" (initiated by a user). This article addresses the technical limitation regarding the Active Directory Password Synchronization Agent’s ability to differentiate between these two actions.

Environment

Identity Manager

Cause

The Active Directory Password Synchronization Agent functions as a standard Windows Password Filter. The Windows Password Filter API provides minimal context for password change events; it does not pass information regarding the user role (e.g., Administrator vs. Standard User) or the method used to trigger the password change. Consequently, the agent cannot programmatically differentiate between an administrative reset and an end-user password change.

Resolution

It is not possible to configure the Active Directory Password Synchronization Agent to distinguish between administrative password resets and user-initiated password changes.