Resetting Passwords

Role required

Operator or Administrator. Auditors cannot reset passwords.

Standard reset (single approval)

1. Open the Users page and find the account.
2. Click the account row to select it.
3. In the action panel, disengage the safety lock.
4. Click Reset password.
5. In the dialog:
   • Enter the new password in both fields, or click Generate to create a random strong password.
   • Check Must change password at next logon if you want the user to set their own password on first login (recommended).
6. Click Reset.

DirWarden sets the password in Active Directory and records the operation in the audit log. The user can log in with the new password immediately.

Tip

If you used Generate, copy the password before closing the dialog — it is not stored anywhere after the dialog closes.

Dual-approval reset

When an Administrator has configured an approval threshold (e.g. “require approval for password resets”), the flow adds a second confirmation step:

1. Complete steps 1–6 above. Instead of applying immediately, DirWarden opens a Pending approval dialog.
2. A second person with Operator or Administrator role must open Settings → Pending approvals, find the request, and click Approve.
3. Once approved, DirWarden applies the reset and logs both the request and the approval with separate audit entries.

If no one approves within the configured timeout (default: 30 minutes), the request expires and must be re-submitted.

Reset options

Option	Effect
Must change at next logon	User is forced to set a new password at their next login. The temporary password you set is one-time use only.
Generate password	Creates a random password meeting the domain password policy (length, complexity).
Manual password	You enter a password. DirWarden validates it against the domain policy before submitting.

If the reset fails

Error	Cause
”Password does not meet complexity requirements”	The password you entered does not satisfy the domain password policy. Use Generate or choose a stronger password.
”Access denied”	The AD service account does not have Reset Password permission on the target OU. Ask your Administrator to delegate the right.
”Account not found”	The account was deleted or moved since the user list was last loaded. Refresh the list with F5.