Changing a Domain User Password on the Hideez Server

Changing a Domain User Password via the Hideez Server

Feature Overview

This feature enables domain users to change their on-premise Active Directory password through the Hideez Server. The updated password is securely stored on the Hideez Key and used automatically during login via Hideez Client.

Prerequisites

Before getting started, make sure the following conditions are met:

• Integration between the Hideez Server and Active Directory is properly configured.

• The user is created manually on the Hideez Server or imported from Active Directory.

• The user must have a Hideez Key with status “Ready”, “Active” or “Reserved”.

• The Hideez Client is installed on a workstation joined to the Active Directory domain.

• The workstation is approved on the Hideez Server.

Step 1: Creating a Domain Account

1. Log in to the Hideez Server as an administrator.

2. Go to the user list, select the desired user, and open their profile.

3. Click Create personal account.

4. In the creation form, fill in the required fields:

   • Name* – a friendly name for the account.

   • Login Type – select AD Domain Account.

   • Login* – the username the user uses to log in to Active Directory.

   • Domain* – the name of the Active Directory domain connected to the Hideez Server.

   • User Logon Name – domain user logon.

5. Check the Skip Password checkbox.

6. Click Create to save the account.

Step 2: Initial Workstation Login

The user logs in to a workstation joined to the Active Directory domain and connects their Hideez Key to the Hideez Client.

Step 3: Setting the Current Password

After connecting the key, the domain account from the server is automatically written to it. The user must enter their current domain password via the Hideez Client interface. This password must be known to the user.

Note: After the current password is entered, the user will be able to log in using this domain account via the Hideez Key and Hideez Client — the password will be automatically retrieved from the Hideez Key. To enable this, the administrator must first create the account on the Hideez Server, and the user must enter the correct password for their domain account. From that point on, the user can continue using this account to log in and will be able to change the password independently according to the organization’s security policies.

Step 4: Changing the Password via the Hideez Client

To change the domain account password:

1. Open the Hideez Client.

2. Select the relevant domain account.

3. Click Edit.

4. Check the Change logon password checkbox.

5. Enter a new password.

6. Click Save.

During the password update process, the following steps occur:

• The current (old) password is read from the key.

• The old and new passwords are used to initiate the password change in Active Directory via the Windows API.

• If successful, the new password is written to the key, replacing the previous one.

Additional Notes

• The new password must not match any previously used password for this account.

• The domain’s password policy must allow a password change at the time of the request. For example, if there is a minimum password age policy (e.g., no more than one change per 24 hours) and the previous change was recent, the system will prevent the new password from being set until that time has passed.

• In hybrid infrastructures, the password is updated in both on-prem Active Directory and Azure AD (if synchronization is configured).

• For more detailed information on password policy requirements, see the official Microsoft documentation on password policy settings in Active Directory.