# As an admin / security officer, I want to force a user to change a password after a given time **URL:** \ **Category:** Done!\ **Created:** [September 24, 2018, 12:51pm UTC](https://community.passbolt.com/t/as-an-admin-security-officer-i-want-to-force-a-user-to-change-a-password-after-a-given-time/1067 "2018-09-24T12:51:34Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![martijndevrieze](https://avatars.discourse-cdn.com/v4/letter/m/278dde/32.png) [@martijndevrieze](https://community.passbolt.com/u/martijndevrieze)\ **Post date:** [September 24, 2018, 12:51pm UTC](https://community.passbolt.com/t/as-an-admin-security-officer-i-want-to-force-a-user-to-change-a-password-after-a-given-time/1067/1 "2018-09-24T12:51:34Z")
**Q1. What is the problem that you are trying to solve?** Coming from the world of KeePass like password managers I am used to having passwords expire, where my password manager will force me (the user) to change the password. This goes beyond what is requested in “[As a logged in user I should know if a password is about to expire and should be changed](https://community.passbolt.com/t/as-a-logged-in-user-i-should-know-if-a-password-is-about-to-expire-and-should-be-changed/61)” As security officer I want the password manager rather than any other application dictate whether passwords expire or not. On top of this I want to be able to expire passwords within a group when members of that group leave my organization **Q2 - Who is impacted?** Any security officer and user who puts his privacy before convenience (and therefore uses a password manager) as well as all users of applications that do not enforce password expiry. **Q3 - Why is it important and/or urgent?** This is a very comon way to enforce password hygene as well as a very logical and straightforward step to ensure confidentiality of my application stack. Assuming a group of users has access to all kinds of applicatiosn and 1 user leaves (group or org), the need for resetting passwords, or enforcing thereof, is a basic security requirement. **Q4 - What is your proposed solution? (optional)** Add an optional “Expires on” or “expires after n days” field, which will trigger a change password flow within PassBolt: Password can be used to login the application the password belongs to, user then changes the password, changed password gets saved into PassBolt by the user. If the user does not change the password within an ‘x’ amount of time, the password gets removed from PassBolt. Admin edit: added poll bellow. ---
**Author:** ![remy](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/remy/32/17_2.png) [@remy](https://community.passbolt.com/u/remy)\ **Post date:** [September 24, 2018, 12:54pm UTC](https://community.passbolt.com/t/as-an-admin-security-officer-i-want-to-force-a-user-to-change-a-password-after-a-given-time/1067/2 "2018-09-24T12:54:15Z")
**Q5. Community support** People can vote for this idea to show traction: _Poll ([view on site](https://community.passbolt.com/t/as-an-admin-security-officer-i-want-to-force-a-user-to-change-a-password-after-a-given-time/1067/2))_ ---
**Author:** ![remy](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/remy/32/17_2.png) [@remy](https://community.passbolt.com/u/remy)\ **Post date:** [September 24, 2018, 8:09pm UTC](https://community.passbolt.com/t/as-an-admin-security-officer-i-want-to-force-a-user-to-change-a-password-after-a-given-time/1067/3 "2018-09-24T20:09:10Z")
@martijndevrieze I think this is a reasonable and good feature to have, except maybe for the “If the user does not change the password within an ‘x’ amount of time, the password gets removed from PassBolt.”. What about just nagging the user until they do it? Some systems do not have a “reset password” feature so straight up deleting data could be a problem. ---
**Author:** ![martijndevrieze](https://avatars.discourse-cdn.com/v4/letter/m/278dde/32.png) [@martijndevrieze](https://community.passbolt.com/u/martijndevrieze)\ **Post date:** [September 25, 2018, 4:14am UTC](https://community.passbolt.com/t/as-an-admin-security-officer-i-want-to-force-a-user-to-change-a-password-after-a-given-time/1067/4 "2018-09-25T04:14:16Z")
Nagging indeed will do the trick as well. Although nagging can be ignored, which I have seen people do for long stretches of time. Indeed deleting a password might be too much of a risk. ---
**Author:** ![aars](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/aars/32/418_2.png) [@aars](https://community.passbolt.com/u/aars)\ **Post date:** [March 26, 2019, 4:11pm UTC](https://community.passbolt.com/t/as-an-admin-security-officer-i-want-to-force-a-user-to-change-a-password-after-a-given-time/1067/5 "2019-03-26T16:11:02Z")
IMHO password aging is bad practice and pushes users towards password re-use/rotation/plus-one-ing (PreviousPass111111, or TheDefaultPasswordITGaveMe+1). Other people share this opinion: [https://www.schneier.com/blog/archives/2016/08/frequent\_passwo.html](https://www.schneier.com/blog/archives/2016/08/frequent_passwo.html) ---
**Author:** ![derClef](https://avatars.discourse-cdn.com/v4/letter/d/7ba0ec/32.png) [@derClef](https://community.passbolt.com/u/derClef)\ **Post date:** [March 27, 2019, 9:10am UTC](https://community.passbolt.com/t/as-an-admin-security-officer-i-want-to-force-a-user-to-change-a-password-after-a-given-time/1067/6 "2019-03-27T09:10:14Z")
I think this could be irritating for many users. My understanding is that people use password managers for security and convenience. This is a major bump on the second. I also don’t see how strong passwords become automatically less secure over time. You would have to assume bad practices where passwords are leaked in some way, but these should be rare incidents rather than the norm, else your security is in a bad spot either way. Assuming you passwords are unsecure after X days is probably an over-generalized guess and consequently (more often than not) a waste of your users time. Furthermore, if all passwords of a group have to be changed (like in the example given in Q3) it should be the group manager’s responsibility to restore security and update all necessary passwords. Passbolt can automate none of that for you - the problem has to be detected and solved by manual labor - so I don’t see any real benefit here. ---
**Author:** ![NoelTorres](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/noeltorres/32/502_2.png) [@NoelTorres](https://community.passbolt.com/u/NoelTorres)\ **Post date:** [September 17, 2019, 3:54pm UTC](https://community.passbolt.com/t/as-an-admin-security-officer-i-want-to-force-a-user-to-change-a-password-after-a-given-time/1067/7 "2019-09-17T15:54:53Z")
Changing passwords when a member leaves the group MUST NOT be directed by the password manager. It MUST be performed on the system with a password, and then reflected on the password manager, as part of the Leave Policy. ---
**Author:** ![remy](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/remy/32/17_2.png) [@remy](https://community.passbolt.com/u/remy)\ **Post date:** [February 15, 2024, 5:22pm UTC](https://community.passbolt.com/t/as-an-admin-security-officer-i-want-to-force-a-user-to-change-a-password-after-a-given-time/1067/8 "2024-02-15T17:22:22Z")
The ability to manual set an expiry date and expiry policies was added in v4.5.