Technical Tip: Change LDAP Password while FortiAuthenticator Windows Agent is installed with push notification

Consider that FortiAuthenticator Agent is already installed and communicating with FortiAuthenticator.

If not, check the below article and guide:

https://community.fortinet.com/t5/FortiAuthenticator/Technical-Tip-Windows-agent-is-not-fetching-available-domains/ta-p/201527

https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/bb02bb94-dbf0-11ea-96b9-00505692583a/FortiAuthenticator_Agent_for_Microsoft_Windows-3.2.0-Install_Guide.pdf

FAC workflow:

FAC ==== PC(FAC Agent)
||
(AD)

Prerequisites:

FortiAuthenticator.

- Create remote LDAP server connection (domain admin user used as bind username).
- Create remote sync rule and import some LDAP users.
- Assign token to user and allow push notification.

Windows 10:

- Install FortiAuthenticator  agent 3.7.
- Login to Windows using 2FA to verify push notifications.
- Press Ctrl+Alt+Del and select Change a password.

- Select 'Enter'.
- Wait for the push token page to appear.

- Approve push FortiToken notifications from the app.

The following log messages should appear in the Agent logs after changing the password:

2021-12-21 18:00:59,355 [3016|31|DEBUG] : [Credential.cpp:2129] Credential::GetOfflineCachePath: Offline Cache Path: C:\Program Files\Fortinet\FortiAuthenticator Agent\Offline\LABDC\tuser1

2021-12-21 18:00:59,371 [3016|32|DEBUG] : [Credential.cpp:1112] Credential::ReportResult ... Password change completed, resetting usage scenario.

2021-12-21 18:00:59,371 [3016| 8|DEBUG] : [Credential.cpp:1124] Credential::ReportResult: Password verified, perform post-logon actions

Note.

If Domain Controller Event logs is checked, it is possible to notice that an event 4723 stating that the password has been changed.

Make sure 'Minimum password age' in the GPO under 'Password Policy' is set to 0 days.