I have roughly 3500 users that we want to soon enable the Single-Signon feature of the Notes client. Currently most Notes users have a password complexity that is higher than our Active Directory requirements. Some also have complexity that is lower.
How can I change everyones password complexity so that it matches what we have tested to be the proper level? I do not want to force them to change their password yet, but rather make the change so when they do change their password they will have the proper complexity setup.
Is there a way to recertify everyone and change the complexity? Is this done with a password policy? Will this cause a mass change of passwords?
You pose a scenario not unique to your company, but fairly widespread in many Notes Domino shops.
Given what you say about some of your users having either a higher or lower password complexity serves to address a core issue, the delta between the AD password requirement and the Notes user.id password requirement.
From a practical administrative standpoint, the closer [if not exactly the same] the password requirements are, the fewer amount of single client logon issues you might potentially expect.
Having said the above, I would recommend you consider;
change the AD password requirement to be EQUAL to Notes
The alternative of re-registering several hundred, if not a few thousand users is certainly not pleasant. So if you wanted to make the Notes user.id password requirement the same as your existing AD password requirement, you would have to seriously consider that option of re-registering your user community.
Clearly, changing the AD password requirement is much easier and far less time consuming than re-registering many, many users.
About single client logon functionality. Are you aware that it is an optional installable component and there are a couple of different ways to install it?
I would also suggest you consider invoking password synchronization [ Notes user.id < > Notes http password ] as it is very easy to do [via Domino policy] and a logical & practical extension of an effective single client logon deployment.
Hope this posting was of assistance to your efforts.
Starting in 6.5.something, you can use custom password policies to specify your own custom password requirements, including minimum password quality, password minimum and maximum length, and a variety of other odd little tweaks. That should give you enough flexibility to bring your Notes and AD password requirements to fairly equivalent settings.
The custom password policy will be automatically downloaded during authentication into the ID files of all of the users to whom that policy is applied, so there is no need for the old mail-based recertification process to change the password strength on the ID file.