question Re: Regarding the Password Expiration Reminder Feature in Community Central forum

Regarding the Password Expiration Reminder Feature

SotaT — Fri, 24 Oct 2025 07:49:58 GMT

I want to set an expiration date for passwords and notify users when the expiration date approaches. From my research, ServiceNow has a property called “pwd_reset.enable.password_expiration_reminder.” Setting this to true seems to enable the feature.
However, it seems the reminder feature doesn't work with the local credential store. It appears we need to create an external credential store. Furthermore, creating a credential store seems to require installing a separate spoke. Is this understanding correct?

If it's possible to set password expiration and create a reminder feature using only standard functionality without installing plugins, I would appreciate your guidance.

Re: Regarding the Password Expiration Reminder Feature

MaxMixali — Fri, 24 Oct 2025 08:36:56 GMT

ServiceNow – Password Expiration and Reminder Configuration

Question Summary
----------------
You want to set an expiration date for user passwords and notify users when their password expiration date approaches. You found the property “pwd_reset.enable.password_expiration_reminder” but noticed it doesn’t seem to work with the local credential store. You’re asking whether it’s necessary to create an external credential store or install an additional spoke.

Detailed Answer
----------------
1. **Property Overview**
- The property **pwd_reset.enable.password_expiration_reminder** (boolean) enables password expiration reminder notifications.
- When set to **true**, it allows ServiceNow to send reminders to users whose passwords are about to expire — **only if password expiration is configured and managed via the Credential Store**.

2. **Local Credential Store Limitation**
- The **local ServiceNow credential store** (where users authenticate directly via the ServiceNow login page) does **not** natively support password expiration or reminders.
- Password expiration and enforcement policies are **not managed** within the local user table (`sys_user`) for standard ServiceNow authentication.

3. **External Credential Store Requirement**
- To use password expiration reminders, ServiceNow expects integration with an **external credential store** (e.g., LDAP, Azure AD, Okta, or another Identity Provider) that manages password policies, including expiration.
- ServiceNow can then read and relay expiration data from that external system.

4. **Credential Store Setup**
- External credential stores are defined in the **Credential Store framework** (introduced for password resets and identity management).
- The credential store configuration may require installation of the **“Password Reset” plugin** or **Credential Store Spoke**, depending on your version.

Example plugins:
- **Password Reset (com.glideapp.password_reset)** → provides core password management functionality.
- **Credential Store Spoke** → enables integration with third-party identity systems.

5. **Without Installing Additional Plugins**
- ServiceNow **does not natively** handle password expiration reminders for local user accounts out of the box.
- However, you can simulate similar behavior using **scheduled jobs and notifications**:
- Add a custom **“password_expiration_date”** field on the `sys_user` table.
- Use a **Scheduled Script Execution** to check for users whose password expiration date is within X days.
- Send an **email notification** to those users via standard notification templates.

Example pseudo-script:
```javascript
var gr = new GlideRecord('sys_user');
gr.addQuery('active', true);
gr.addQuery('password_expiration_date', '<=', gs.daysAgoStart(-7)); // within next 7 days
gr.query();
while (gr.next()) {
gs.eventQueue('password.expiration.reminder', gr, gr.email, '');
}
```

6. **Recommendation**
- If your organization uses **SSO / External Authentication**, handle password expiration in that identity provider.
- If using local ServiceNow authentication, you can only **customize** the expiration logic through scripting, as no OOB configuration exists for reminders without a credential store.

Summary
-------
- The property `pwd_reset.enable.password_expiration_reminder` works **only with external credential stores**.
- For **local accounts**, password expiration and reminders must be custom-built via scripts and notifications.
- Installing the **Password Reset plugin** or **Credential Store Spoke** enables the official, supported approach.

Best Practice
--------------
- For enterprise environments, delegate password management to **SSO or external ID providers** (Azure AD, Okta, LDAP).
- Avoid storing or managing passwords directly in ServiceNow where possible for security and compliance reasons.

Re: Regarding the Password Expiration Reminder Feature

Ankur Bawiskar — Fri, 24 Oct 2025 09:19:51 GMT

@SotaT

here is a KB from ServiceNow with custom solution

Force Password Reset 90 Days After Last Change

the docs link does say this

💡 If my response helped, please mark it as correct ✅ and close the thread 🔒— this helps future readers find the solution faster! 🙏

Re: Regarding the Password Expiration Reminder Feature

Ankur Bawiskar — Fri, 24 Oct 2025 09:16:10 GMT

@SotaT

do you have users brought via LDAP or you have local accounts as well?

Re: Regarding the Password Expiration Reminder Feature

SotaT — Fri, 24 Oct 2025 09:22:54 GMT

There are only local accounts. Only users manually created in sys_user.

Re: Regarding the Password Expiration Reminder Feature

MaxMixali — Fri, 24 Oct 2025 09:59:15 GMT

Password Expiration and Reminder Configuration in ServiceNow
============================================================

Overview
--------
The property `pwd_reset.enable.password_expiration_reminder` enables password expiration reminders, but it only works when password expiration is actively managed through a credential store that supports expiration metadata. For standard local authentication, this feature does not function by default.

How It Works
-------------
ServiceNow manages authentication via Identity Providers (IdPs) and Credential Stores:
- Local Credential Store: Uses `sys_user.password` and does not include built-in expiration logic.
- External Credential Stores: LDAP, Azure AD, Okta, etc., can manage expiration and notify users externally.
- The reminder feature depends on having a **Managed Credential Store** with password expiration data.

Limitations with Local Credential Store
----------------------------------------
If you rely on local authentication (no external IdP):
- There is no built-in password expiration or expiry date field.
- The property `pwd_reset.enable.password_expiration_reminder` does not trigger notifications.
- Custom logic is needed to simulate expiration and send reminders.

Approaches
-----------

Option 1 – Use Password Reset (PRF) with Managed Store
------------------------------------------------------
1. Install the **Password Reset** plugin (`com.snc.password_reset`).
2. Set the property:
pwd_reset.enable.password_expiration_reminder = true
3. Configure a **Managed Credential Store**:
- Go to: *Password Reset → Credential Stores → New*
- Define the store (local or external like LDAP/Azure AD).
4. Add an **Expiration Policy** under *Password Reset → Expiration Policies*.
5. Set up email notifications to alert users before expiration.

✅ Works with both local and external credential stores.

Option 2 – Custom Scheduled Job for Local Users (No Plugin)
-----------------------------------------------------------
1. Add a field to `sys_user`: `u_password_expiration_date` (Date/Time).
2. Create a Scheduled Script Job:
```javascript
var gr = new GlideRecord('sys_user');
gr.addQuery('u_password_expiration_date', '<=', gs.daysAgoStart(-5));
gr.addQuery('active', true);
gr.query();
while (gr.next()) {
gs.eventQueue('custom.password.expiration.reminder', gr, gr.email, '');
}
```
3. Create an Email Notification triggered by `custom.password.expiration.reminder`.

⚙️ Manual but effective for on-prem/local-only users.

Option 3 – Integrate with External Identity Source
---------------------------------------------------
If your org uses LDAP, Azure AD, Okta, or Ping:
- Delegate expiration and reminders to the IdP.
- Configure SSO (SAML/OIDC) in ServiceNow.
- Manage expiration policies in the IdP itself.

This is the **recommended enterprise solution** for large environments.

Summary
--------
| Approach | Requires Plugin | Works for Local Users | Auto Expiration | Reminder Supported | Recommended For |
|-----------|----------------|-----------------------|-----------------|--------------------|-----------------|
| Password Reset (Managed Store) | ✅ Yes | ✅ Yes | ✅ Yes | ✅ Yes | Full ServiceNow control |
| Custom Script Job | ❌ No | ✅ Yes | ⚙️ Manual | ⚙️ Custom | Local-only environments |
| External Identity Provider | ❌ No | ❌ No | ✅ Yes | ✅ Yes | Enterprise SSO environments |

Recommendation
---------------
- For enterprise users: manage expiration in your **IdP** (Azure AD / LDAP).
- For standalone instances: install **Password Reset** and enable reminders.
- For isolated setups: use a **custom scheduled script**.

Re: Regarding the Password Expiration Reminder Feature

Simon Hendery — Fri, 24 Oct 2025 19:33:17 GMT

Hi @MaxMixali - please stop posting replies that are simply cut-and-pasted from ChatGPT. It doesn't help anyone.