User has new password in AD, but GlobalProtect still authenticates with the old password (new password fails).

[jrauman]

When our users change their AD password, they immediately will lock & unlock Windows to make sure the new password took, and that what they think they changed it to, is exactly what they changed it to.  They also have been told to sign out of GlobalProtect and sign back in, so that GlobalProtect will be configured to use the new creds going forward.  However, while the password change in AD has been working great, GP has not been keeping up with the changes.  Some users will lock their accounts trying to use their new passwords in GlobalProtect.  Others will give up and try the old one, which works until the next time they connect and then it fails and locks the account in AD.  This happens all too frequently.  We use the User-ID Agent on Active Directory Windows 2016 servers. Our PA is 9.1.8, our agents are 9.1.2-9 and GlobalProtect is 5.1.5.  

1. is this a known issue with GP?  we've been seeing it for over a year.

2. does GP and/or PA cache our user's credentials?  if so, can we disable that feature?  and if we can, is there a downside to doing that as well?  we want every GP connection to check our domain controllers for proper credentials, every time (if there isnt a significant downside).

[T.Dudouit]

Hello Guys !

We are experiencing the same problem in our company from long time and we have not found any solution so far.

Sometime, the Windows account was lock after changing the password in the active directory.
It seems that the change is not taken into account by Global Protect and this results in the account being locked when user trying to LogOn. We have to manually change the password in Global Protect for this to work and unlock windows account in AD to solve this issue.

We opened tickets in costumer portal for this issu, but the proposed solutions do not work parmanently.

Out GP version is 6.1.1-6

Anyone's idea ?

Thanks for Help

Best Regards !