Provisioning Reference Guide › Advanced Configuration Options › Domain Configuration › Password Parameters › Pre-expire Passwords

Pre-expire Passwords

Values: No (default) or Yes

Description: Controls having new global users that are created with their passwords already expired, forcing users to change their passwords during the initial login. If you set this parameter to Yes, global users that are created from non-interactive interfaces have their password that is initially set as expired. This is represented in the global user properties as a value of 1 for the property PwdPreExpired. This option appears on the global user's property sheet as the Force one-time expiration (mark password as temporary) check box.

The setting of the password as initially expired occurs when global users are created through the following interfaces:

• Correlate. When acquiring a primary endpoint, global users are created for each account. These users will generally not have a password unless you set a constant value using the Create Users Default Attributes parameter that described previously. Enabling the Pre-expire Passwords parameter will cause the global users to be created with passwords that are initially expired. If you set a value for PwdPreExpired using the Create Users Default Attributes parameter, that value takes precedence over one specified by enabling the Pre-expire Passwords parameter.
• CA IdentityMinder Server, ETAUTIL, or other on-demand clients. If you create a single global user using the batch utility (ETAUTIL) or some other on demand LDAP client, these users will start out with expired passwords if you enable the Pre-expire Passwords parameter and do not otherwise specify a value of the PwdPreExpired property.

If you create a global user using an interactive client such as Provisioning Manager, whether the global user's password is initially expired or not is determined from the value of the PwdPreExpired property that provided when the global user is created. In Provisioning Manager, you control this value by selecting or clearing the check box labeled Force immediate expiration (one-time). Provisioning Manager automatically selects the Force one-time expiration (mark password as temporary) field if the Pre-expire passwords parameter is enabled. To disable this default behavior, clear the field before creating the global user.