On Mon, Feb 13, 2006 at 03:58:31PM -0800, Howard Chu wrote: > >What's missing? > > Read the slapo-ppolicy(5) manpage again, look for pwdReset. Aha, got it, thanks! I was wrongly assuming that "password reset by administrator" meant a password change done by the administrator, and not literally setting the pwdReset attribute.