Okta Privileged Access Password Rotation Fails for Active Directory Service Accounts

After configuring Okta Privileged Access (OPA) to rotate passwords for Active Directory (AD) service accounts, the rotation fails. This issue occurs due to insufficient permissions for the AD agent or mismatched password policies. Resolve this issue by granting the AD agent account the correct permissions, updating the OPA password policy to meet AD requirements, and restarting the AD agent.

The System Log displays the following errors during the password rotation attempt:

Jun 15 16:39:14 Okta System (SystemPrincipal) (PAM) password rotation finished for a service account FAILURE: failed to sync password to target app <user@domain.com> (Service Account) <team> (Team)
Jun 15 16:37:49 Okta System (SystemPrincipal) (PAM) password rotation finished for a service account DEFERRED <user@domain.com> (Service Account) <team> (Team)

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Privileged Access (OPA)
• Active Directory (AD)

This issue occurs for two primary reasons. First, the user account running the Okta AD agent lacks the necessary permissions to change passwords in AD. Second, the OPA password rotation policy generates passwords that do not meet the minimum length, complexity, or history requirements defined in the AD password policy.

How is the Active Directory password rotation error resolved in Okta Privileged Access?

Update the Active Directory agent permissions, align the password policies, and synchronize the users.

1. Verify and update the permissions for the user account running the Okta AD agent to ensure it has the authority to change user passwords in AD. Test the permission by running the Set-ADAccountPassword command in PowerShell and entering the credential of the service account used by the Okta AD agent.
   
   Set-ADAccountPassword -Identity "ADusername" -NewPassword (ConvertTo-SecureString "TempPassword123!" -AsPlainText -Force) -Reset -Credential (Get-Credential)
   Enter the AD agent service account credentials into the Windows PowerShell credential prompt.
    
   Review the PowerShell output to confirm the password change succeeded, then validate it by logging in with the new credentials.
    
2. Review the AD password policy requirements, including minimum length, complexity, and password history.
3. Navigate to the OPA Admin Console > Resource Administration > Resource management > [Target Resource Group], then update the password rotation policy to ensure generated passwords meet or exceed the AD password policy requirements.
4. Restart the Okta AD agent service on the host server to apply the permission changes.
5. Navigate to the OPA Admin Console > Resource Administration > Resource assignment > [Target AD] and execute the Synchronize app users action to manually trigger the synchronization process, if necessary.