topic Re: AD Account Expired in Horizon Desktops and Apps

AD Account Expired

Procpio — Fri, 01 Feb 2019 06:43:24 GMT

URL : http:////docs.vmware.com/en/VMware-Horizon-Client-for-Windows/4.9/horizon-client-windows-user/GUID-427B0E44-2089-426D-84A1-AD0181D997D1.html

Topic Name : VMware Horizon Client for Windows User Guide

Publication Name : VMware Horizon Client for Windows User Guide

Product/Version : VMware Horizon Client for Windows/4.9

Question :

Hi, We have users which their AD accounts have expired already in active directory. This is not about password expiry. They are trying to login on Horizon Client but the error is only Logon failure: Unknown user name and password. It should be something like Account has expired. Is this a limitation of Horizon Client or Horizon 7?

Re: AD Account Expired

BenFB — Fri, 01 Feb 2019 16:52:20 GMT

Horizon supports changing a expired password as long as the account is not locked out.

Do you by chance use a MFA solution through RADIUS? We've seen where that will result in what you are seeing and it's a known limitation.

Re: AD Account Expired

Procpio — Mon, 04 Feb 2019 05:02:08 GMT

We don't use MFA. Just AD authentication. Even without MFA is it still a known limitation?

Re: AD Account Expired

BenFB — Mon, 04 Feb 2019 16:21:07 GMT

Are you getting an error message? My password expired last week and I successfully changed it by connecting to Horizon using my old password and then I was prompted to change it. You should see something similar to this image that I found online.

Re: AD Account Expired

Procpio — Thu, 07 Feb 2019 02:35:49 GMT

We don't have issue for users which password has expired already. They can change their passwords similar to the image you shared.

Our problem is with AD users with expired accounts.

For an expired account when they try to login the error they receive is "Logon failure: Unknown user name and password". The error should be something like i.e. "Login failure: Account has expired"

Re: AD Account Expired

BenFB — Sun, 10 Feb 2019 06:53:21 GMT

My understanding is that there is not a way for Horizon to know that. Active Directory treats a expired password the same way as a locked account.

Re: AD Account Expired

Procpio — Tue, 12 Feb 2019 02:28:38 GMT

Yes its correct. VMware support checked internally and confirmed that the user expiration status for an account will be available in backend logs,
however, in user interface though the account is expired we will be getting the invalid username or password error during login attempt.

It will be raised as a feature request with their product team which will be considered for upcoming release.

Re: AD Account Expired

BenFB — Tue, 12 Feb 2019 05:19:57 GMT

According to our internal AD team this is a Microsoft limitation. When a password is expired it essentially sets the same bit as if the account was locked out so it's one in the same.