Let's assume the following in a hospital:
- Each nurse has her own Active Directory user, with a password.
- The password expires automatically 90 days after the password was set.
- A nurse uses her own Active Directory user name and password to log in to applications in the hospital.
- They never log in to Windows with their user name and password. Instead, each department has its own user name and password. The nurses who work for that department log in to Windows with the user name and password of the department. This is because one computer could be used by multiple nurses without having to log off an on every time.
The problem is that the nurse doesn't know when her password will expire. And when it has expired, the nurse can't reset her password because the old password has expired. We have to ask for the old password when resetting the password because that is the only way we can authorize the user.
What would be a good way to prevent the password of a nurse from expiring? In other words: how to assure that each nurse resets her password before it expires?