How to configure the advanced password reset policy in ADSelfService Plus

Last updated on:

In this article

Overview

This article explains how to configure the advanced password reset policy in ADSelfService Plus. It covers all the settings available under the Reset & Unlock tab in the Advanced configuration dialog box, including how to enable automatic account unlocks, enforce Active Directory password history, activate the password strength analyzer, and control identity re-verification behavior during self-service password resets.

What is the advanced password reset policy?

The advanced password reset policy in ADSelfService Plus is a set of administrator-controlled settings that determine how users perform self-service password resets and account unlocks in Active Directory (AD). These settings go beyond the standard options available in the Default Domain Policy or Group Policy Objects (GPOs) and allow administrators to enforce additional security controls—such as breach-checked auto-generated passwords, copy-paste restrictions, and real-time password strength feedback—without modifying Active Directory Domain Services (AD DS) directly.

The advanced password reset policy is configured per policy object, meaning different rules can be applied to different sets of users, organizational units (OUs), or groups.

Prerequisites

Before configuring the advanced password reset policy, ensure the following:

  • ADSelfService Plus is installed and the initial setup is complete.
  • You are logged in to ADSelfService Plus with administrator privileges.
  • At least one policy object is configured under Configuration > Self-Service > Policy Configuration.
  • The Reset Password and/or Unlock Account self-service features are enabled for the relevant policy.
  • Users are enrolled in ADSelfService Plus with at least one identity verification method configured.
  • If you plan to use the Have I Been Pwned? (HIBP) integration for breach-checked auto-generated passwords, ensure the HIBP integration is enabled under Admin > Product Settings > Integration Settings > Have I Been Pwned..

Steps to configure the advanced password reset policy

  1. Log in to ADSelfService Plus as an administrator.
  2. Navigate to Configuration > Self-Service > Policy Configuration.
  3. Click the edit icon next to the policy you want to configure, or click Add New Policy to create a new one.
  4. Click Advanced in the bottom-right corner of the Policy Configuration page.
  5. In the Advanced dialog box, click the Reset & Unlock tab.
  6. Configure the following settings as required:
    • Unlock account during password reset: Enable this option to automatically remove a user's Active Directory account lockout when they reset their password. Users will not need to wait for the account lockout duration to expire or contact the help desk—the unlock is performed as part of the same self-service action.
    • Upon password reset, force users to change password at next logon: Enable this option to set the pwdLastSet attribute to 0 after a self-service reset, requiring users to create a new password the next time they log on. This mirrors the User must change password at next logon attribute in Active Directory and is useful for organizations that need to demonstrate password rotation under compliance frameworks such as NIST SP 800-63B, HIPAA, and PCI DSS.
    • SMS/Email auto-generated password to users after identity verification: Enable this option to have ADSelfService Plus automatically generate a password based on the custom password policy configured in the product and deliver it to the user via SMS or email after they complete identity verification. If the generated password does not comply with the password policy, or if the Have I Been Pwned? integration identifies it as a previously compromised password, the user is redirected to the reset page to set their password manually.
    • Prevent a user from using 'Copy & Paste' in the password fields: Enable this option to disable the Copy and Paste commands in the password input fields on the reset page. This prevents users from pasting passwords from unsecured sources and encourages the creation of a new, unique password during each reset.

      Note: This setting may affect autofill behavior in some password managers. Test against your organization's password manager before enabling it broadly.

    • Allow users to retry reset without going through ID verification again: Enable this option to let users reattempt a password reset without repeating the identity verification process if their chosen password is rejected for not meeting the Active Directory domain password policy or fine-grained password policy (FGPP) requirements. This reduces reset abandonment without compromising the verification already completed.
    • Enable Password Strength Analyzer: Enable this option to display a real-time password strength meter below the new password field as users type. The meter us es color-coded indicators to evaluate password strength based on entropy:
      1. Red: Weak password
      2. Yellow: Moderate password
      3. Green: Strong password
    • Enforce Active Directory password history settings during password reset: Enable this option to enforce the password history configuration from the Active Directory domain password policy or fine-grained password policy (FGPP) during self-service password resets. This prevents users from reusing previously used passwords and ensures that self-service resets comply with the same history rules enforced by the domain.
  7. Click OK to save your changes.

Validation and confirmation

After configuring the advanced password reset policy, use a test account to verify that the settings are enforced correctly.

  1. Assign the configured policy to a test user, group, or OU.
  2. Log out of ADSelfService Plus and attempt a self-service password reset as the test user.
  3. Verify each enabled setting behaves as expected:
    • If Unlock account during password reset is enabled, confirm the account lockout is cleared upon reset.
    • If Force users to change password at next logon is enabled, confirm the user is prompted to change their password at the next Windows logon.
    • If Prevent Copy & Paste is enabled, confirm that pasting into the password field is blocked on the reset page.
    • If Password Strength Analyzer is enabled, confirm the strength meter appears below the new password field and updates as you type.
    • If Enforce password history is enabled, confirm that reusing a previous password is rejected during the reset.
  4. If the HIBP integration is active, attempt to use a known compromised password in the auto-generated password flow and confirm the user is redirected to the manual reset page.

Tips

  • Enable Unlock account during password reset to reduce help desk tickets for account unlocks, which typically account for a significant portion of password-related support calls.
  • Use Enforce Active Directory password history settings alongside the Password Policy Enforcer feature to prevent users from cycling back to old passwords through self-service resets.
  • Enable the Password Strength Analyzer together with ADSelfService Plus's custom password policy to guide users toward creating stronger passwords without relying on prescriptive character-class rules alone.
  • If your organization uses an enterprise password manager, test the Prevent Copy & Paste setting thoroughly before enabling it—some password managers rely on autofill methods that may be affected.
  • Apply different advanced password reset policy configurations to different policy objects to enforce stricter controls for privileged accounts, such as IT administrators or finance users, while keeping a smoother experience for standard users.
  • Regularly review and test the configured settings after any changes to your Active Directory domain password policy or fine-grained password policies to ensure alignment.