asked on

Can a secret question and answer be stored in Active Directory (Server 2008 R2) for self service password reset (Forgotten Password)?

We are developing a web site that uses Active Directory security. We would like to store all information pertaining to users authentication credentials in Active Directory. I have seen many references to ASP.Net Active Directory security model in the .Net framework classes. In order to make password resets self service we would like to use the secret question and answer method to allow users to reset their password if they can answer the secret question correctly. Is this ability native to Active Directory, or would we have to modify the schema to allow this?

ASKER CERTIFIED SOLUTION

illhelpu

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

jwright2375

ASKER

Thank you very much for your suggestion illhelpyou. In the newest version Forefront Identity Manager, we would have to install SharePoint in the DMZ, which is not an option right now. We want to develop a lightweight solution. If Active Directory cannot handle this natively, we have planned to store the old secret question and answer information in SQL Server with a salt and hash. I so hoped it was built into AD 2008, but it looks like to build the functionality in, we will have to install and manage 2 additional server products. Wow, that seems like a lot more work than we can handle.