topic Re: Anyone use "Expired Active Directory Password Change for Remote Users" in PAN version in General Topics

Anyone use "Expired Active Directory Password Change for Remote Users" in PAN version 8.1 and GP Ver

junior_r — Tue, 05 Jun 2018 21:33:36 GMT

Hi,

Anyone use "Expired Active Directory Password Change for Remote Users" in PAN version 8.1 and GP Version 4.1?

https://www.paloaltonetworks.com/documentation/41/globalprotect/globalprotect-app-new-features/new-features-released-in-gp-agent-4_1/expired-active-directory-password-change-for-remote-users

Does it work? Can you do it with LDAP or do you have to use radius? Any gotchas?

Thanks

Re: Anyone use "Expired Active Directory Password Change for Remote Users" in PAN version

_slv_ — Sun, 17 Jun 2018 17:20:49 GMT

Hello

I have the same problem as You...

Is it possibly that noone is using prelogon feature for password reset?

For what reason we have Radius connection? Is it nessesary for AD password change according to this link?

Please help us!

Regards

Slawek

Re: Anyone use "Expired Active Directory Password Change for Remote Users" in PAN version

Remo — Sun, 17 Jun 2018 17:41:45 GMT

@_slv_

Yes, the pre-logon feature can be used for password changes or setting a new password when the user is required to. But if you use also the single sign ln feature you have to choose the Global Protect login option and if this option is chosen, passeord reset/change no longet work so the user has to change back to the default login option to change the password and after that he has to change again to the global protect login option to make single sign on work again...

... this works for IT people, but not for "normal" users who would then call the hotline every time ... so this feature sounds good with the password change in the GP application, but I did not test it so far.

Re: Anyone use "Expired Active Directory Password Change for Remote Users" in PAN version

_slv_ — Sun, 17 Jun 2018 18:03:53 GMT

@Remo

I don't use SSO for GP (most out laptops are not AD joined) but those users from such laptops conect to computers that are joined to AD (RDP connection).

According to link I think that pre-logon feature is not for me...

Thx for explanation!

Regards

Slawek