Configuring a Policy Xpress policy to enable "User Must Change Password at Next Logon" for AD accounts - Identity Manager

Products

• CA Identity Suite
• CA Identity Manager

Issue/Introduction

This article outlines the procedure for configuring a Policy Xpress (PX) policy to update Active Directory (AD) accounts, automatically setting the "User Must Change Password at Next Logon" attribute upon task completion.

Environment

Identity Manager 14.5 & 15

Resolution

To enable this functionality, configure a PX policy that triggers on the "Task Completed" event. Ensure your task configuration supports account synchronization (e.g., AccountSync=OnEveryEvent) so that the AD account exists prior to policy execution.

1. Create the PX Policy: Define a new policy with the type Submitted Task and set it to execute on Task Completed.
2. Define Data Element (Get Accounts): Create a data element to retrieve AD accounts:
   • Name: AD Account List
   • Category/Type: Accounts
   • Function: Get
   • Endpoint Type: ActiveDirectory
3. Define Data Element (Iterator): Create an iterator to process the list:
   • Name: AD Account List Iterator
   • Category: System
   • Type: List Iterator
   • Function: Next Object
   • Value or List: {'AD Account List'}
4. Create Action Element: Set the password attribute:
   • Name: Set pwdLastSet
   • Category/Type: Accounts / Set Account Data by Identifier
   • Function: Set
   • Endpoint Type: ActiveDirectory
   • Account Identifier: {'AD Account List Iterator'}
   • Attribute Name: User Must Change Password at Next Logon (pwdLastSet)
   • Value: true

Additional Information

Note: Before implementation, review Explaining IM Task Settings to verify that your account provisioning lifecycle allows the account to be created before the PX policy runs.

To speak with a customer representative or a Support Engineer see Contact Support. Scroll to the bottom of the page and click on your respective region.