I have a Red Hat Enterprise Linux VM which has been integrated with Windows AD using Kerberos and Winbind. It all works, bar one feature. In AD, I can reset the users password and select the option 'User must change password on next logon'. When I use this account to logon to Windows, I am obviously prompted to change the password. When I login via Linux (SSH) I am not prompted to change it. How can set this up so Linux prompts the user based on this option from AD:

Force Password Reset


You haven't made it clear what version of RHEL you're using. I will assume you are using a supported version (6.8 or 7.3).

First thing's first, winbind does not support password changes, at least not natively. You can maybe make a pam configuration change to assist in this, but you may run into the dreaded The change of the authentication token failed error.

To make your life simpler, I highly suggest using sssd and adcli/realm to work with Active Directory. If using 7.3, you will have the realm command, which will automatically setup sssd.conf, krb5.conf, and your pam.d configurations in a sane manner. On 6.8, you will only have adcli, which will require some manual configuration changes on your part or using the authconfig command to setup sane defaults. Users that need their passwords changed will be prompted and it will work when using this method. It is supported and is recommended by Red Hat to use sssd and the realm or adcli commands.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.