We set up password recovery for all our OU’s and registered all of our users with the CA process. However, it looks like the password recovery only applied to about half of the users (the ID recovery database is populated by about half the ID’s there should be). For the life of me I can’t find the distinguishing reason why some users have the password recovery and others don’t. All OU’s have some users with password recovery working, but none of them have all their users covered.
I have read that when the CA process is used, password recovery only gets applied after the user logs in. This doesn’t appear to be true in our case, since the ID recovery database was half populated after our initial user registration (when no clients had even been set up yet). Since that time, no additional ID’s have ever been added to the recovery database even though users have been logging in every day. I have confirmed that no recovery information exists for those user ID’s that are not in the recovery database.
If anyone has any insights that might be helpful, it would be much appreciated. Thanks.