When a user password is reset and require user to change password at logon is select, the user cannot sign into AAD joined devices with the new password

Craig Owings 21 Reputation points
2021-04-01T21:44:32.48+00:00

When I have users forget there password and we reset their password in AD and have the "require user to change password at logon" checked, users get a message logging into their AAD joined machines stating "The sign-in method you're trying to use isn't allowed, Try a different sign-in method or contact your system administrator". Logging in with the old password works, if they know it, but if they don't they can't get in. We have to remove the requirement to change the password at logon and then the new password will work, and then they'll never change the password. Is it supposed to work like that?

Windows 10 Security
Windows 10 Security
Windows 10: A Microsoft operating system that runs on personal computers and tablets.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
2,754 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,474 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Siva-kumar-selvaraj 15,551 Reputation points
    2021-04-07T10:24:09.393+00:00

    Hello @Craig Owings ,

    Thanks for reaching out and apologize for delayed response.

    It is typical to force a user to change their password during their first logon, especially after an admin password reset occurs. It is commonly known as setting a "temporary" password and is completed by checking the "User must change password at next logon" flag on a user object in Active Directory (AD).

    The temporary password functionality helps to ensure that the transfer of ownership of the credential is completed on first use, to minimize the duration of time in which more than one individual has knowledge of that credential.

    To support temporary passwords in Azure AD for synchronized users, you can enable the ForcePasswordChangeOnLogOn feature, by running the following command on your Azure AD Connect server:

    Set-ADSyncAADCompanyFeature -ForcePasswordChangeOnLogOn $true

    Note: You should only use this feature when SSPR and Password Writeback are enabled on the tenant. This is so that if a user changes their password via SSPR, it will be synchronized to Active Directory.

    For more information read: https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-password-hash-synchronization#synchronizing-temporary-passwords-and-force-password-change-on-next-logon

    Hope this helps.

    -------------------

    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.