Configuring the Password Aging Settings for Expiration <\/h2>\n\n\n\n
JumpCloud\u2019s Password Aging settings for expiration apply globally for your entire organization. Access and manage these settings from Settings<\/strong> > Security <\/strong>> Password Settings<\/strong>. Learn more in Manage Password and Security Settings<\/a>.<\/p>\n\n\n\n Considerations<\/strong>:<\/p>\n\n\n\n To manage Password Aging settings<\/strong>:<\/p>\n\n\n\n You can set the following settings for password expiration:<\/p>\n\n\n\n <\/a>Considerations for Allow password change after expiration<\/strong>:<\/p>\n\n\n\n When you create new users, you can give them a temporary password. To make sure users change their password to a private, secure password quickly, you can require that they change their password the next time they log in to their JumpCloud-managed device. <\/p>\n\n\n\n Read considerations for Allow password change after expiration<\/a>.<\/p>\n\n\n\n To require a new user to change their temporary password<\/strong>:<\/p>\n\n\n\n You can manually expire passwords for individual users from the User panel. <\/p>\n\n\n\n Read considerations for Allow password change after expiration<\/a>.<\/p>\n\n\n\n To immediately expire a user\u2019s password and force them to change their password<\/strong>:<\/p>\n\n\n\n You can manually expire passwords for multiple users from the Users list. <\/p>\n\n\n\n Read considerations for Allow password change after expiration<\/a>.<\/p>\n\n\n\n To immediately expire multiple users’ passwords and force them to change their password<\/strong>:<\/p>\n\n\n\n The following flows assume the Allow password change after expiration<\/strong> setting is enabled for an organization.<\/p>\n\n\n\n Require a New User to Change their Temporary Password<\/strong><\/p>\n\n\n\n The following flow applies when admins select to require a new user to change their temporary password: <\/p>\n\n\n\n An Existing User\u2019s Password Expires<\/strong><\/p>\n\n\n\n The following flow applies when a user\u2019s password lifespan expires:<\/p>\n\n\n\n Expire an Existing User\u2019s Password<\/strong><\/p>\n\n\n\n The password for a Samba user, which is the Samba Service Account, cannot be expired.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n The following flow applies when an admin expires an existing user\u2019s password, unless the user is the Samba user: <\/p>\n\n\n\n This section describes legacy behavior for password expiration. See Manage Password and Security Settings<\/a><\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n When enabling password expiration for a JumpCloud organization, the default behavior is to set the password expiration date to the same date and time for all users of a JumpCloud organization. To limit the number of accounts that are set to expire on a given date and time, admins can create a phased, rolling password expiration policy for their organization.<\/p>\n\n\n\n This can be done by enabling the Password Never Expires<\/strong> setting for all users in an organization before enabling password expiration for an organization and then disabling the setting for batches of users at a time.<\/p>\n\n\n\n Need to install the JumpCloud PowerShell module to automate this task? See Install the JumpCloud PowerShell Module<\/a>.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n For organizations that already have password expiration in place, the steps can also be implemented, but doing so will update all users’ existing password expiration dates.<\/p>\n\n\n\n Only once the Password Never Expires<\/strong> setting is disabled per user will the global password expiration setting apply to the user’s account. <\/p>\n\n\n\n Examples from the JumpCloud PowerShell Module example library are used to modify users and implement a rolling password expiration policy:<\/p>\n\n\n\n When the setting Password Never Expires<\/strong> setting is disabled for a user, the user\u2019s account will be set to expire at the current time plus the number of days configured for expiration. As an administrator, you can choose the duration between batches of users you disable the expire setting for in your organization.<\/p>\n\n\n\n Organizations may want, or sometimes have an immediate need, to have their entire user base reset passwords. There are many ways to facilitate this with the JumpCloud. There are advantages and disadvantages for each option, ways to initiate the reset flows, and variations in user experience that result.<\/p>\n\n\n\n Password reset using password expiration settings<\/strong><\/p>\n\n\n\n Expiration is a well worn method of enforcing rotation of passwords. This is typically used to manage password aging in a rotating fashion, but it may also be employed to enforce a more urgent reset across an organization\u2019s user base. This method allows some customization in how that reset is enforced and experienced by users.<\/p>\n\n\n\n All users receive certain nudges from JumpCloud when their passwords are near expiration. These include:<\/p>\n\n\n\n A daily notification will appear to a user on a managed device with the JumpCloud tray app nudging them to use the app to reset their password. This will start within 10 days prior to their password expiration. This looks slightly different on Macs and Windows.<\/p>\n\n\n\n To review expiration settings:<\/strong><\/p>\n\n\n\n Before enforcing any form of password expiration, there are a few settings that should be reviewed to ensure that expiration will not have undesired consequences on managed resources.<\/p>\n\n\n\n To initiate a reset within a limited timeframe:<\/strong><\/p>\n\n\n\n This is a good option if there is a desire to enforce a reset, but urgency allows for this reset to take place within a prescribed timeframe. Providing a window of time for users to perform a reset can be less disruptive to productivity and distribute the potential admin remediation should a user experience confusion or challenges with the reset.<\/p>\n\n\n\n To initiate a reset immediately:<\/strong><\/p>\n\n\n\n This method of initiating reset will be far more disruptive to active users within an organization and will also ensure that compromised passwords are no longer active. Please consider the urgency of action appropriate to the identified vulnerability.<\/p>\n\n\n\n When passwords expire, users will lose access and their account status will be updated on all JumpCloud managed resources. This may include access to emails that can notify them of expiration, communication applications commonly used to recover users, devices, and networks those devices are connected through.<\/p>\n\n\n\n If opting to force a reset via expiring passwords immediately, consider if you would like users to be able to self-recover from this expiration. The \u201cAllow password change after expiration\u201d will allow users to use their expired password to enter a reset flow in the JumpCloud User Portal or a managed device at login.<\/p>\n\n\n\n Password reset using a reset request<\/strong><\/p>\n\n\n\n If there isn\u2019t great urgency, requesting a reset of passwords is the least disruptive option for initiating an org wide reset. While protecting productivity, when a request isn\u2019t disruptive, it also tends to be less effective in prompting users to take action, so this is not a recommended path of remediation if there is a concern that passwords may be compromised.<\/p>\n\n\n\n To send an admin-specified reset request:<\/strong><\/p>\n\n\n\n There is a way to send a password reset request through the JumpCloud Admin Portal that comes in the form of an email to each users\u2019 company email address. The users follow a link in the email to a reset form that requests a new password and a confirmation of that password. This is a simple flow, but as mentioned above, users may be rightfully skeptical of the request if they aren\u2019t expecting it\u2014if you decide to use this method, we suggest letting users know in advance to expect the email from JumpCloud. There is also a potential that if users have devices JumpCloud managed by JumpCloud, they may need to confirm their password is synced to their device.<\/p>\n\n\n\n\n
\n
\n
\n
\n
\n
\n
Managing Password Expiration for New Users with Temporary Passwords<\/h2>\n\n\n\n
\n
Managing Password Expiration for Existing Users<\/h2>\n\n\n\n
\n
![\"\"](\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/02\/user-force-password-change.png\")
<\/figure>\n\n\n\n\n
Managing Password Expiration for Multiple Existing Users<\/h2>\n\n\n\n
\n
Allowing a Password Change After Expiration<\/h2>\n\n\n\n
\n
\n
\n
\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/note-icon.png\"){kind=icon}
<\/p><\/div>\n
\n
Implementing a Rolling Password Expiration Policy<\/h2>\n\n\n\n
<\/p><\/div>![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/tip-icon.png\"){kind=icon}
<\/p><\/div>\n
Forcing an Org-Wide Password Reset<\/h2>\n\n\n\n
\n
![\"\"](\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/02\/password-about-to-expire-1024x648.jpg\")
<\/figure><\/div><\/div>\n\n\n\n![\"\"](\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/02\/n-days-remaining-1024x650.jpg\")
<\/figure><\/div><\/div>\n<\/div>\n\n\n\n![\"\"](\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/02\/menu-bar-notification.jpg\")
<\/figure>\n\n\n\n\n
![\"\"](\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/02\/settings-security-password-configs.jpg\")
\n\n
\n
\n
![\"\"](\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/02\/n-days-until-password-expiration-setting-1024x448.jpg\")
<\/figure>\n\n\n\n\n
![\"\"](\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/02\/force-password-change-1024x328.jpg\")
<\/figure>\n\n\n\n
![\"\"](\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/02\/password-reset-email-user-895x1024.jpg\")
<\/figure>\n\n\n\n