Configure the password expiration warning message
Active Directoryusers and user groups that use the PSO (Password Settings Object) method to set the maximum password age, you can configure
theto allow users'
BlackBerry Workapps to display a warning message when their
Active Directorypassword is about to expire.
By default, this feature is disabled.
For information on displaying a warning message for users that use the GPO (Global Policy Object) method to set the maximum password age, see the
BlackBerry Workadministration content.
- Make sure that you have the following information:
- Logon credentials for the service account that is used to authenticate to the domain controller.
- LDAP server name and port number. The LDAP server name must be one of the Domain Controllers.
- Verify that the service account has READ permissions to the "Password Settings Container". For instructions, see Add Read permission to the account used to authenticate to the LDAP server.
- Verify that administrators use the PSO method to set the maximum password age for the users.
- Verify that users in your environment are runningBlackBerry Work3.8 or later.
- In theBlackBerry Enterprise Mobility Server Dashboard, underBlackBerry Configuration, click
- ClickPassword Expiry Settings.
- Select thecheckbox to allowEnable LDAP LookupBEMSto queryActive Directoryfor password expiry details for the users.
- In thefield, type the name of the LDAP Server (for example, ldap.<LDAP Server NameDNS_domain_name>).
- In theLDAP Server Portfield, type the port number of the LDAP server. By default, the port number is 389.
- Optionally, select theEnable SSL LDAPcheckbox to tunnel data through an SSL-encrypted connection. If you enable SSL LDAP, the default port is to 636. This step requires you to import the LDAP certificate into theBEMSkeystore. For instructions, see "Upload the Microsoft Exchange Server SSL certificate to the BEMS database" in the BEMS-Core configuration content.
- In thefield, enter the base DN for the LDAP search. If this entry is not set,LDAP Base DNBEMStries to find the base DN in the namingContexts attribute.
- Enter the LDAP Logon User Name and password. You can enter the username in the formatdomain\usernameor User Principal Name (UPN)username@domain.
- ClickTestto test the connection to the LDAP server.