Technical Tip: How to Force password change for FortiGate admin account on next login

pmeet · ‎03-25-2024

Description

This article describes how to enable the force-admin password change feature for FortiGate admin accounts.

Scope

FortiGate.

Solution

To enable this feature it is mandatory to first enable the password-policy status on the FortiGate:

config system password-policy

set status enable ----------> Default is disabled.

end

Once it is enabled, a force-admin password change feature becomes available on GUI and CLI as well.

Via GUI:

Via CLI:

config system admin

sh full
edit "admin"
set remote-auth disable
set accprofile "super_admin"
set comments ''
set vdom "root"
unset ssh-public-key1
unset ssh-public-key2
unset ssh-public-key3
set ssh-certificate ''
set schedule ''
set force-password-change disable ---> enable
set two-factor disable
set email-to ''
set sms-server fortiguard
set sms-phone ''
set guest-auth disable
set password ENC
set allow-remove-admin-session enable
next
end