Is 'Minimum Password Age' Policy applicable only for Change Password and not applicable for Reset Password?

Question

Hi. I am aware that Change Password requires both Old and New password to change one's password, while Reset Password doesnt require one's Old Password to change user's password.

I wanted to understand whether 'Minimum Password Age' password policy would be applicable only during Change Password.

I am using System.DirectoryServices namespace and i observe different behaviors for SetPassword and ChangePassword invoke methods

1. with DirectoryEntry.Invoke("SetPassword", object[]), the 'Minimum Password Age' policy doesnt seem to have effect and i am able to reset password everytime i invoke it.
2. With DirectoryEntry.Invoke("ChangePassword", object[]), the 'Minimum Password Age' policy seems to restrict me to change the password as per the days set in the policy.

Requesting someone to confirm if 'Minimum Password Age' Policy is not applicable for Reset Password(SetPassword) operation and is this the expected behavior?

Answer 1

Hi @Anonymous

Yes this is intended behavior. The two methods are using two different AD permissions, as they are intended for two different use cases. The change Password method is designed to allow users to change their own password, while the reset password is used for admins to reset a users password, and doesn't require them to know the users existing password, as this is an admin operation, it does bypass the minimum password age requirement but not the complexity requirements.

The change password method requires the Change Password permission on the user object, typically there are two permissions assigned to a user object, one for Everyone which is used to allow the user to change their password from the Windows GINA (logon screen) and Self to allow the user to change their password after they have logged on.

For the Reset method the Reset Password permission is required on the user object, this normally assigned to an admin or service desk role.

Gary.

Answer 2

Hello,

Can Windows GINA (logon screen) display domain specific password policies such as 'Minimum Password Age 2 weeks' ? Additionally of saying "Domain specifiy rules, sorry password change wasn't successfully" In case a unknown rule or policy hits the user.

Thank you!