User Account Management
The User Account Management screen allows you to add new user accounts so they can use the Password Reset Portal, send Enrollment Emails to them, see various attributes relating to the user's AD account, and unlock/reset their account if required.
When importing user accounts, we also query the following domain and account attributes. If you experience any issues importing accounts, i.e. errors like AD attribute blank or not found, possibly it is a permission issue within your domain:
Domain Attributes
maxPwdAge (Default Domain Password Policy) msDS-ResultantPSO (Fine Grained AD Password Policy) msDS-PasswordSettings (Fine Grained AD Password Policy) msDS-MaximumPasswordAge (Fine Grained AD Password Policy)
User Account Attributes
SAMAccountName givenname sn (Surname) name objectSid mail objectCategory=person objectClass=user user.UserCannotChangePassword user.PasswordNeverExpires user.LastPasswordSet user.UserPrincipalName
Account Details
On the Account Details tab for a user, you can see various attributes for their Active Directory account, as well as unlock/reset their account if required.
Ideally the user should be using the Portal to reset/unlock their own account, but under certain conditions this may not be possible. If an Administrator of Passwordstate is required to unlock/reset a user's account, they must specify a reason as to why they need to do this - that way a report can be generated to see if there are any trends which can be addressed, which would hopefully increase the use of the Password Reset Portal.
Verification Methods
The Verification Methods tab allows an Administrator of Passwordstate to specify settings for any one of the available Verification Policies for the user. Ideally the user would be specifying the relevant settings when they Enroll to use the Portal, but Administrators can change/override these settings if required.
Account Lockout Monitoring
The Account Lockout Monitoring tab will show any bad login attempts, or account lockout events, for the user's account. Event ID's 4740 (account lockout) and 4771 (pre-authentication fail i.e. Bad Login attempt). This tab may help you identify where a user is getting locked out, if it continues to happen regularly.
