<html> <head> <meta http-equiv="content-type" content="text/html; charset=utf-8"> </head> <body text="#000000" bgcolor="#FFFFFF"> Hi, I am setting up an LDAP connection from our Identity Management system which provisions our IPA servers with fresh users and groups. I set it up pretty nice so far, with some added privileges for change admin passwords and avoiding password resets. But when we create a brand new user with a password, IPA resets the krbPasswordExpiration to match the IPA password policy - but we have another policy in our central identity management which gets must get set at user create time. So the question is: Is there any way I can avoid getting krbPasswordExpiration reset to match the password policy? and a followup question: Is this the same with AD sync? passwords from AD gets synced, but expiration is determined by local password policies on the IPA servers? <div class="moz-signature">-- <meta http-equiv="content-type" content="text/html; charset=utf-8"> <title></title> <meta name="generator" content="LibreOffice 4.2.8.2 (Linux)"> <meta name="author" content="Martin Mortensen"> <meta name="created" content="20150224;91312788439017"> <meta name="changedby" content="Martin Mortensen"> <meta name="changed" content="20150224;92319227743406"> <style type="text/css">  </style> Martin R Mortensen Linux Specialist University of Copenhagen </div> </body> </html>