This message was deleted.

Maybe change to Citrix fas? With in session use. Then the user can change his password, but the cert is the same 😂

Will put it to the customer....

I think with Imprivata OneSIgn you can achieve that aswell. But it will cost big bucks

User education (You could potentially script it, if pwd changed less than x min, prompt user to log off) or SD to deal with this stuff. I tried to fix that, I couldn't find a better option.

Interesting on the script - how would you read the "password changed" attribute? Just by querying AD on some scheduled task in the background?

Yes that's how I would do it