Chaning Notes Password when it's not known

Greetings,

I support aDomino 6.5 server running for a small company that tends to have a lot of employee turnaround. I’ve had to basically teach myself Domino administration, which has proven frustrating. Still, I’ve figured out to set up new users, work with basic NSF file nuances on our AS400, etc.

One thing that is driving me nuts is the tpyical scenario when a user forgets their Notes password. I’m sick of having to blast their account and re-create it because Domino Admin and IBM Corp assume this never happens and system Admins are not to be trusted with ACL rights.

How do I change the password (not the internet password) for a Notes user when it’s not known?

Subject: I refer you to the Administrators Help Db. (Just typed password into the index view).

Before users can recover their ID files, you must set up a centralized mail or mail-in database to store encrypted backups of ID files and specify information about which administrators – known here as recovery authorities – are allowed to recover IDs. You must perform these steps before anyone loses or corrupts an ID – ideally before you begin registering users. 1. From the Domino Administrator, click Configuration, and then click Certification.

  1. Click Edit Recovery Information.

  2. In the “Choose a Certifier” dialog box, click Server and select the registration server name from the Domino Directory (only if the correct server name does not appear).

  3. Choose the certifier for which you are creating recovery information.

If you are using a server-based certification authority, click “Use the CA process” and select a certifier from the drop-down list. You must be a Certificate Authority (CA) administrator for the certifier in order to change ID recovery information.

If you are not using a server-based certification authority, click “Supply certifier ID and password.” If the certifier ID path and file name does not appear, click Certifier ID and select the certifier ID file and enter the password.

  1. Click OK. The “Edit Master Recovery Authority List” dialog box appears.

  2. Enter the number of recovery authorities that are required to recover an ID file. It is recommended that you choose at least three.

  3. Click Add and select the names of the administrators who are the designated recovery authorities.

  4. Choose whether you want to use an existing mailbox for recovery information or create a new one.

If you have a mail or mail-in database already set up for recovery information, click “I want to use an existing mailbox.” Click Address and select the database from the Domino Directory.

If you want to create a new database to store recovery information, click “I want to create a new mailbox.” In the “Create New Mailbox” dialog box, enter the name of the server on which the database is to be created, and the database title. You can use the file name that is created from the database title, or you can create a new one.

Note Whenever you make changes in this dialog box, the Export button is disabled. You cannot export recovery information until you save the new or updated information.

  1. Click OK.

  2. If you are using a server-based certification authority, at the server console type:

load ca

This starts the CA process with the new recovery information, or refreshes it if it is already running. Then type:

tell adminp process all

to process the request to add recovery information to the certifier.

  1. In the mail-in database ACL, set the -Default- access to No access and give administrators Reader access.

Note If you have created additional O-level Notes certifiers, be sure to cross-certify them with the initial Notes certifier prior to setting up recovery information.

Subject: RE: I refer you to the Administrators Help Db. (Just typed password into the index view).

You’ve got to be F----ing kidding me. That’s what I have to do to change a user’s Notes password? I’ve got one admin account at this site. I’m not setting up server clustering, running a division of Boeing, or replicating to multiple sites in Sri Lanka and Ireland. One server - one site - less than 100 users - one Administrator who can’t justify hiring a full time Notes admin.

Uh, I’ll just blast their account off Notes, and recreate it. 1/10 the work.

Subject: Once you set it up, its pretty easy to use. They recommend 3 recoverers, but you can use just 1.

Subject: Chaning Notes Password when it’s not known

Helpsoft’s ID Manager works quite well I’m finding. It has an ID Vault and is relatively secure. Plus the automation is really neat.

Subject: Chaning Notes Password when it’s not known

“because Domino Admin and IBM Corp assume this never happens”

No, IBM assumes that Notes admin know that it is mandatory to have backups of all user ID files to pull out WHEN user forget their passwords – because it’s assumed that they eventually WILL.

There is NO WAY to change a password on an ID file if you don’t know the current one; the current password MUST be used to decrypt the private key before you can re-encrypt it with the new password.

However, there are password crackers you can buy which use brute-force, dictionary, and other techniques to crack the password on a given ID file, so that you DO know it again, and can therefore change it.

You really should, however, have a backup system in place, from something as simple as a copy on a network drive with a known password (ans which will fail if the user’s name changes) to a thrid-party solution or the BUILT-IN Notes technique (http://www-12.lotus.com/ldd/doc/domino_notes/Rnext/help6_admin.nsf/855dc7fcfd5fec9a85256b870069c0ab/f93152df1897eaaf85256c1d003987cd?OpenDocument)

Subject: Chaning Notes Password when it’s not known

Maybe I missed something, sorry if I did, but all you have to do is setup for Password Recovery.

Read this:

http://www-10.lotus.com/ldd/today.nsf/lookup/ID_password_recovery

If you have CA setup, then you might want to get some additional information.

HTH

Subject: RE: Chaning Notes Password when it’s not known

I just took the simple option for my set up.

When I create a new user, I take a backup of the id file and store it on a network share that only trusted people have access to. I always create new Ids with the same default password, so if anyone forgets their password, or loses a laptop without having a backup of their ID, I can just pull down a copy of the original id file used when that user’s account was created. Sometimes its necessary to recertify the id, but that’s no big problem.

Its not the most secure way to do things, but its simple, and I can’t see why it wouldn’t be suitable for your situation.

Subject: RE: Chaning Notes Password when it’s not known

That is how we do it here. We store the id’s on the server where the mail acct resides and use a common password. If they forget their password, we delete the id file they are using and drop in a copy of the original for them to use. Name changes can be a bit frustrating, but don’t really happen that often and can be dealt with.

Subject: Chaning Notes Password when it’s not known

Helpsoft’s ID Manager works quite well I’m finding. It has an ID Vault and is relatively secure. Plus the automation is really neat.