8861 Collab Edge phones logging out AD accounts

[HillyardK]

We have a number of Collab Edge phones setup for users to have desk phones at home in country and out of country.

We have received reports that certain users are getting their AD accounts locked out and the reports are pointing to these phones are trying to log the user's back in with a cached password.

Can someone please explain how this is possible or if something might be setup in CUCM to auto login these phones?  My team has tried to replicate the same issue on our own Collab phones and when our passwords expire, we go to the Sign in screen with a message to Verify the user name and password and try again.  We cannot get them to login with a cached password.

If someone knows how the phones are auto logging the old passwords and how to turn it off, can you please share that will me?

[Roger Kallberg]

I would recommend you to use the registration code option instead of logging in with user name and password combination as what you describe is exactly the expected outcome when the PW in AD is changed. With reg code you don't use that info any longer, as it uses a OAuth refresh token instead and that has no correlation with user name and PW combination. To use activation code there are a few different things you need, specifically on the device you need to set this.

The highlighted option is set once to be able the generate the code, the UI changes when this is set, and then it will be unselected again once the phone has used the code to register. There is a whole section in the admin and maintenance document on this, recommend that you read this.

On you specific question, this would likely be the setting on the phone that makes this happen when the PW is altered.

[HillyardK]

Thank you Roger for your response.

Our current CUCM version does not offer the Activation code option.

We have also checked the phones and the User Credentials Persistent for Expressway Sign In is not enabled on the specific phones, in the Common Phone Profile Configuration, or in the Enterprise Phone Configuration.

For some reason our phones created in our North America cluster that are physically located in Singapore are somehow caching the passwords and locking our users out.  

We have North America phones setup at locations in NA that we have let sit and even though the phone screens do not leave the Sign In page, the account logs are pointing to these phones are attempting to sign in. 

The problem is we have no idea what exactly is trying to sign in because the phones don't leave the login screen.

[Roger Kallberg]

What version of CM do you have? I think that this option should be available in all present supported versions, ie 11.5, 12.5 and 14.

[HillyardK]

11.5 and moving to 12.5