When there are users in password-invalid account lock state, relaxing a password character string restriction might release some users from the password-invalid account lock state. Before changing password character string restriction, make sure it is acceptable to release these users from the password-invalid account lock state.

The following is the procedure for identifying the users who will be released from the password-invalid account lock state.

Procedure

1. Check for users in the password-invalid account lock state. For details about how to perform this check, see 25.4.1(1) Check for users in password-invalid account lock state.
2. Perform an advance check of the restriction that is being considered. For details about how to perform an advanced check, see 25.5 Checking for users who will be placed in password-invalid account lock state.
3. Identify the applicable users based on the differences in the results from steps 1 and 2.

Care must be exercised in strengthening one restriction while relaxing another restriction. For example, a user might attempt to change a password before the implementation date in order to avoid violation of a new restriction. However, the user might not be able to make the change because it violates the current restriction. In such a case, the password must be changed so that it satisfies both the current and the proposed restrictions.