For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

AlgebraicMirror's avatar
AlgebraicMirror
Icon for Altostratus rankAltostratus
Jul 27, 2015

Can APM Active Directory expired password reset functionality be turned off?

Does anyone know how to disable the functionality of the APM login page where it prompts a user to change their password if their Active Directory password is expired? I'd like to simply reject users...
BIG-IP Access Policy Manager (APM)
deployment
microsoft
security
Algebraic_Mirror's avatar
Algebraic_Mirror
Icon for Cirrostratus rankCirrostratus
Jul 27, 2015

Yes, I have it set to disabled. But that setting only controls whether the user gets prompted before their password expires. It doesn't affect what happens once their password is actually expired. In that case, APM always has them try to reset it.

 

My other thought was setting the "Max Password Reset Attempts" to 0, but in the GUI zero isn't an option in the dropdown. Only the numbers 1-5 are options.

 

So I still can't find any way to turn it off, unless it's possible to set it to 0 manually via TMSH or bigip.conf (but I was a little nervous about trying that since I don't know if that's a supported configuration).