Setting up password changing on Michrosoft Windows system¶
This topic contains an example of setting up password changing to Microsoft Windows account over WMI.
Note
Windows WMI password changer
Using Windows WMI password changers requires granting sufficient permissions to regular users.
Run the
winrm quickconfig
command to detect any potential issues, turn on the LocalAccountTokenFilterPolicy option and unblock ports on internal firewall.In case the winrm is unavailable, execute the following command
cmd /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system /v
LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f
Additionally, unblock WMI and DCOM ports and change the network interface type to Office network.
If neither of the above has brought expected results, the administrator must explicitely asign users and groups priviledges to WMI or DCOM using wmimgmt.msc and dcomcnfg:
Adding a password change policy
- Select > .
- Click to create a new password changing policy.
- Provide password change policy name.
Note
Provide a descriptive name so that anyone administrating Fudo PAM can tell what the policy does at a glance. E.g. 10 minutes, 20 characters, special characters, uppercase
.
- Select Password change enabled and define how frequently the password will be changed.
- Select the Password verification enabled and define how frequently the Secret Manager should verify whether the password has not been changed in any outher way but the Secret Manager itself.
- Provide the number of characters comprising the password.
- Select desired password complexity options and provide the minimal number of characters for each.
- Click to store password changer policy.
Assigning password changer to the privileged account
- Select > .
- Find and click desired account object.
- Provide the privileged account login in the Credentials section.
- Select
with password
from the Replace secret drop-down list. - Provide privileged account password.
- Select your policy from the Password change policy drop-down list.
- In the Password changer section, select the
Unix Account over SSH
from the Password changer drop-down list. - Provide superuser login credentials.
Note
Superuser account enables resetting the password in case the Secret manager detects that it has been changed by someone else.
- Click .
Related topics: