Recently my company has implemented an unlimited password age for our users as long as it is deemed strong by our log provider. The issue we run into now is we have disabled user accounts where their passwords are no longer deemed secure and if they were to ever become enabled they would become vulnerable.
I am reviewing SailPoints capabilities first before looking to Powershell scripts. During provisioning we use a generator which creates a random password for the AD account when it is created however, it does not get stored anywhere and in order to get into their account they must reset their password using their listed contact information (phone or email). I am looking to do the same with deprovisioning.
I would like for SailPoint to somehow kick off the same generator when the account was created to push a random password when deprovisioning is kicked off. If anyone has any suggestions or ideas on how I can go about this desired outcome using SailPoint it would be very much appreciated. Thank you.
My guess is that you are not deleting old AD objects in your terminated users OU, hence your worry about old objects with insecure passwords suddenly becoming active again and compromised. But this might just be about users and not terminated users.
Provided your password policy is setup correctly expiring the password effectively forces any enabled user to reset their password on the next logon.
My main question would be what is the requirement you’re working towards?
there are several ways to go with this, some are easier than others.
from how it sounds, if I was tasked with this, I would do the following on termination
1) disable the account
2) move it to the disabled OU
3) set an identity attribute to sync that sets accountexpiration to 9223372036854775807 if the lifecycle is active or today’s date if it is terminated. >>>this will effectively lock out the account from being used even if someone enables it by mistake.
4) set another attribute that will sync to set pwdlastset to 0 if they are terminated >> this expires the current password, which will force a new password to be used, which they can’t do because we expired the account