PAM error - Change password on domain admins accounts
Hi guys,
we can change various accounts in AD via the pam module without any problems, this works quite well.
Unfortunately we always get an error message when changing the password for domain admin accounts.
Is there any documentation what rights the PAM user needs to be able to change the password for domain admin account?
Thx for your help!
All Comments (5)
Hello,
Please consult the following article.
https://kb.devolutions.net/dvls_leastprivilegespwd.html
Best regards,
Érica Poirier
Hello,
I forgot to mention in my previous post that the PAM provider must be also a domain administrator to update other domain admin accounts.
Best regards,
Érica Poirier
..ahhh ok I think this is the problem, because I have already implemented the other settings.
thx for the fast reply !
Update:
It works with domain admin rights for the PAM provider...thx for the hint.
Found another probem:
If the user is in the "Protected User" group, it is also not possible to change the password, not even with domain admin rights. Is there any solution for this?
Thx a lot!
Hello,
Thank you for your feedback and glad that it works with domain admin rights.
I haven't found any information regarding the required permissions regarding Protected User group. It seems to be quite restrictive being a member of that group! The first idea i would have is to test it with a PAM Provider account that belongs to the Protected User group but I cannot certify that this will even work.
Best regards,
Érica Poirier