24407 User authentication against Active Directory failed

[Arwa Albasari]

Hello,

I am implementing ISE 3.2, and facing an issue where users are unable to change their expired passwords. I receive the following error message:
24407 User authentication against Active Directory failed since user is required to change his password
I have already ensured that the "allowed protocols" configuration permits password changes. However, the problem persists. Has anyone faced a similar issue or can suggest a potential solution?

[Mark Elsen]

 - Can you also check  if the "Enable Password Change" option is set in the Active Directory settings"
    Administration > Identity Management > External Identity Stores > Active Directory > Advanced Settings.

  M.

[Arwa Albasari]

Yes, the "Enable Password Change" option is enabled, but the issue persists.

[ahollifield]

Why are you using PEAP/MSCHAPv2 in 2024?  MS-CHAPv2 uses broken MD4 encryption.  You should move to TEAP using user and device certificates instead.

[Arwa Albasari]

If I use it, does it solve the problem?