Local Admin account forced to change password, after joined to Azure AD

Question

Local Admin account forced to change password, after joined to Azure AD

Trevor Robbins 0

After joining a device to Azure AD for the first time through a work or school account. Ive noticed that the local user account (who is an admin) is forced to restart their password at next sign in. I cant find anywhere in azure or intune that would be forcing this reset.

Dillon Silzer 57,831 Reputation points Volunteer Moderator

2024-04-20T06:18:05.9866667+00:00

Hi Trevor,

Have you taken a look at the default settings in the local security policy?

Were these settings inherited from an image or configuration you made in Intune?
Trevor Robbins 0 Reputation points

2024-04-22T17:08:48.81+00:00

I have taken a look and don't see anything out of the ordinary.

1 answer

Your answer

Dillon Silzer 57,831 Reputation points Volunteer Moderator

2024-04-20T06:18:05.9866667+00:00

Hi Trevor,

Have you taken a look at the default settings in the local security policy?

Were these settings inherited from an image or configuration you made in Intune?
Trevor Robbins 0 Reputation points

2024-04-22T17:08:48.81+00:00

I have taken a look and don't see anything out of the ordinary.

Answer 1

ZhoumingDuan-MSFT 17,165 Microsoft External Staff

@Trevor Robbins, Thanks for posting in Q&A.

To clarify this issue, please check the following.

1.Check if there exist some Intune policy, like conditional access policy, compliance policy that may force Local Administrator account to change their password at next sign in.

2.Check the if there exist security baselines that force Local Administrator account to change their password at next sign in in Intune portal.

If there is any unclear, feel free to contact us.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Trevor Robbins 0 Reputation points

2024-04-22T13:20:56.39+00:00
What in the conditional access policy would cause this?

I am not seeing any security baseline. Where all would this setting be located?
ZhoumingDuan-MSFT 17,165 Reputation points Microsoft External Staff

2024-04-23T06:19:27.3366667+00:00

@Trevor Robbins, Thanks for your update.

1.The setting Require password change may force to change the password.

https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-grant#require-password-change

2.The security baselines located in Endpoint security > Security baselines.

If there is any unclear, feel free to let me know.
Trevor Robbins 0 Reputation points

2024-04-23T13:20:53.5166667+00:00

Nothing in the security baselines. Also, this is for the local user being forced to change their password. The account in question is the account used to setup the computer. Then when joining the device to our domain with a different user credentials. It then forces the local user to change their password after you sign into the azure account.
ZhoumingDuan-MSFT 17,165 Reputation points Microsoft External Staff

2024-04-24T06:13:25.08+00:00

@Trevor Robbins, Thanks for your confirmation.

Based on my research, On Win 10 devices the compliance -password policy affect’s the local user accounts on the machine. However, due to security reasons windows doesn’t store any password metadata so that we don’t expedite brute force efforts. Also, we aggressively purge passwords once they are no longer necessary shortly after logon. As a result, we don’t have the data available at the time that a password policy arrives to know if it is satisfied.

And that’s the reason for password must reset at next logon is that the MDM delivered policy affects local accounts and we as have no means to tell what the current password properties the only method is then the OS has to enforce policy is to mark the local accounts as password has expired.

You can refer the method mentioned in the following link to disable it.

https://cloudinfra.net/enable-disable-user-must-change-password-at-next-logon-using-intune/

Non-official, just for reference.
ZhoumingDuan-MSFT 17,165 Reputation points Microsoft External Staff

2024-04-26T09:17:30.4966667+00:00

@Trevor Robbins, Please tell me if I have fixed your issue successfully. Could you let me know the latest status from your side?

Share via

Local Admin account forced to change password, after joined to Azure AD

1 answer

Your answer