{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":48527,"path":"servicenow-platform/password-reset/config-ad-credential-store.md","title":"Configure the connection to an AD credential store","bundle":null,"doc_type":null,"release":"australia","body":"\n# Configure the connection to an AD credential store\n\nYou can create a Password Reset credential store record to configure access to your Active Directory server while a user is changing or resetting a password. In addition to host connection information, you can specify the password hints that users should see, restrictions on password reuse, the allowed number of failed reset attempts, and other settings.\n\n## Before you begin\n\nRole required: password\\_reset\\_admin\n\n## About this task\n\nThe Microsoft AD Spoke for Password Reset add-on installs the AD Credential store type. The Password Reset Windows Application supports only **Microsoft AD Credential Store**.\n\n## Procedure\n\n1.  Navigate to **All** &gt; **Password Reset** &gt; **Credential Stores** and select **Sample Microsoft AD Credential Store** to use as a template.\n\n2.  Enter a unique and meaningful **Name** and **Description** and then fill in the form.\n\n<table id=\"table_e3x_kff_g1b\"><tbody><tr><td>\n\nType\n\n</td><td>\n\nSelect **Microsoft AD Credential Store type**. A ServiceNow credential store type is a template that provides the required set of capabilities for a particular type of credential store. Credential stores inherit the functionality of the credential store type.\n\n</td></tr><tr><td>\n\nAuto-generate password\n\n</td><td>\n\nSpecify a script include that generates a temporary password for use during the reset process.**Note:** If you select the **Enforce history policy** check box, then you must specify a value for **Auto-generate password** that is compliant with the password policy. There are several options to choose from:\n\n-   An auto-generated password that is compliant with the policy you selected.\n-   An auto-generated password that is Crypto-secure.\n-   A default auto-generated password.\n\n\n</td></tr><tr><td>\n\nEnforce history policy\n\n</td><td>\n\nAppears only if you select a **Microsoft AD Credential Store type** or **Local ServiceNow Instance** credential store type. The Microsoft AD Credential Store type supports history check. The **Enforce history policy** option appears only when the **Supports history check** option is selected for the **Microsoft AD Credential Store type**.\n\nFor information on configuring the setting for credential store types other than AD, see [Configure the connection to a credential store for the Password Reset processes](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/servicenow-platform/password-reset/t_CreateACredentialStore.md). Select the **Enforce history policy** check box to enforce the history policy \\(password reuse\\).\n\nHistory policy \\(password reuse\\): Active Directory domains can be configured to include a history policy that ensures that users don't reuse passwords. For example, the history policy might be configured to not allow the user to reuse any of the previous 10 passwords when resetting a password. This history policy limit is managed by the password\\_history\\_limit verification parameter.\n\n</td></tr><tr><td>\n\nHostname\n\n</td><td>\n\nSpecify the URL or IP address of the credential store.\n\n</td></tr><tr><td>\n\nUser account lookup\n\n</td><td>\n\nSpecify the script include that maps the user ServiceNow platform ID to the user credential store ID. The default script, PwdDefaultUserAccountLookup, returns the user ServiceNow platform user name.\n\n</td></tr><tr><td>\n\nPassword rule hint\n\n</td><td>\n\nSpecify the text that appears on the password reset page to help the user to create a password that meets all requirements. The **Password rule** script enforces the requirements.**Note:** The Password Reset Windows Application supports newline characters in the hint. Other formatting is not supported \\(bold, underline, hyperlink, and so on\\).\n\n</td></tr><tr><td>\n\nPassword rule\n\n</td><td>\n\nSpecify the client script that validates the new password that the user enters. The script is invoked when the user enters a new password and clicks **Password Reset**. You can use the script to enforce password strength/complexity requirements.\n\n</td></tr><tr><td>\n\nEnable Password Strength\n\n</td><td>\n\nSelect the check box to:-   Display the text box for the **Strength rule** script so you can update the script.\n-   Display the graphical **Password Strength** bar to the user while the user changes or resets the password.\n **Note:** The Password Reset Windows Application does not support Password Strength.\n\n</td></tr><tr><td>\n\nStrength rule\n\n</td><td>\n\nThis text box appears only if you select **Enable Password Strength**.Specify the client script that calculates the strength/complexity of the password that the user enters. The script is invoked when the user begins to enter a new password during the reset process.\n\nDefault settings:-   Selected for local ServiceNow credential stores\n-   Not selected for other credential stores\n **Note:**\n\n-   To guide the user during the reset process, the system displays a graphical bar labeled **Password Strength** under the **New password** field.\n\n\\[Omitted image \"password-strength.png\"\\] Alt text: Password strength indicator\n\n-   The Password Reset Windows Application does not support Password Strength.\n\n\n</td></tr></tbody>\n</table>3.  Click **Submit**.\n\n4.  On the domain controller, set **Password Aging** \\(MIN\\_PASSWORD\\_AGE\\) to zero.\n\n5.  To enforce the history policy that is configured for the AD credential store, follow these steps:\n\n    1.  Open the Password Reset process that is associated with the credential store: **Password Reset** &gt; **Processes**.\n\n    2.  On the **Password Reset Details** tab of the Password Reset Process form, clear the **Auto-generate password** check box and then save the process definition.\n\n6.  To enforce the maximum number of attempts to reset the password, in the Password Reset Credential Store Parameters related list, set the value of the **max\\_reset\\_attempts** parameter to the number of allowed failed attempts.\n\n    The default value of 0 \\(zero\\) enables an unlimited number of reset attempts.\n\n    **Note:** The **max\\_reset\\_attempts** setting applies only to Password Reset processes that use AD credential stores.\n\n7.  Click **Submit**.\n\n8.  Set up the [Microsoft AD v2 spoke](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/integrate-applications/setup-ms-ad-v2.md)\n\n9.  [Test the connection to the credential store](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/servicenow-platform/password-reset/test-cxn-to-credential-store.md).\n\n\n**Parent Topic:**[Credentials Store for Password Reset for Active Directory](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/servicenow-platform/password-reset/credentials-store-AD.md)\n\n**Related topics**  \n\n\n[Configure the required strength for passwords](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/servicenow-platform/password-reset/config-pwd-strength-rqmts.md)\n\n"}}