Identity and Active Directory Management

[BradG]

I noticed that newly created accounts set the useraccountcontrol field to

{PASSWD_NOTREQD|NORMAL_ACCOUNT} = 0x220

rather than:

{NORMAL_ACCOUNT} = 0x200

Is there a place to alter this default setting?

[Eugene Pavlov]

Hello,

The PASSWD_NOTREQD flag is set when no password is specified for the new account. Active Directory doesn't allow user creation if the password is empty and this flag is not set.
To force users to specify passwords for new accounts, you can make the Password property required using Property Patterns.
For more details, please see Generate Initial Password on User Creation (on the 3rd step select the Password cannot be empty option).

See also: Set Default Account Options for New Users.

[BradG]

I doing something wrong. In our property patterns I've set the password to be required, and set it to a default value. I've also set the UserAccountControl to a default of "Normal", with the other options unchecked.

When I create an account, the password not required setting still appears, in addition to normal.

[Eugene Pavlov]

Make sure the Property Pattern affects the user.

1. Locate the newly created user in the Console Tree (Administration Console).
2. Right click the user, and click Properties in the context menu.
3. Activate the Effective Objects tab.
4. Click Property Patterns. Your Property Pattern must be in the list.

[BradG]

My property pattern is listed under the user's account properties, under the effective property patterns.

[Eugene Pavlov]

Please post a screenshot of your property pattern.

[Eugene Pavlov]

Another thing, If your property pattern is assigned over members of a group or Business Unit, it will not not be effective during user creation.

[BradG]

PropertyPatterns.jpg (152.95 KiB) Viewed 1952 times

Password Property.jpg (40.03 KiB) Viewed 1952 times

[Eugene Pavlov]

Is the property pattern assigned over All Objects?

[BradG]

Yes - sorry I cut that portion off earlier....

proppatternsfull.jpg (183.22 KiB) Viewed 1951 times