Skip to main content
Lukino
Lukino
Explorer
September 22, 2025
Question

can't change a Windows domain user password from FortiPAM.

  • September 22, 2025
  • 4 replies
  • 589 views


Hi everyone,
I can't change the password from FortiPAM.
In the "Windows Domain Account" or "Windows Domain Account (Samba)" template,
instead of the "target" field,  only the "Domain-Controller" field appears.
The problem is that if I enter the domain controller's IP address in the field, I can no longer access my destination domain server.
So, in the domain controller field, I'm forced to enter the server's IP address because I no longer have the host field.
So, I can access the final server, but I can't change the password.

image.png

Regards

Luca

4 replies

Anthony_E
Staff
Anthony_E
Staff
September 25, 2025

Hello,


Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.


Thanks,

Best Regards
    tbarua
    Staff
    tbarua
    Staff
    September 25, 2025

    Hi Lukino,

     

    Can you please review the following KBs to cross-check your configuration?
    https://community.fortinet.com/t5/FortiPAM/Technical-Tip-Password-change-for-Windows-Domain-Users-through/ta-p/376067

     

    https://docs.fortinet.com/document/fortipam/1.7.0/administration-guide/724480/change-password

     

      Lukino
      LukinoAuthor
      Explorer
      September 26, 2025
      I have tried many times but it doesn't work, I also opened a ticket to support but it is still under investigation
      Lukino
      LukinoAuthor
      Explorer
      October 7, 2025

         

      With support, we managed to change the password for the Windows domain account and we were able to connect to the computer joined to the Windows domain, but not directly from the target Windows machine, but through the Windows domain controller's secret.

       

      Although this isn't optimal since it means enabling the user with a secret that may not be necessary and changing the internal IP, there doesn't seem to be an alternative.

      Terms & ConditionsAccessibility statement