Configure Password Reset Instructions
When a user resets their password, Activate displays guidance explaining the password requirements that must be met before the new password will be accepted. These instructions are intended to reflect the password policy configured for the organisation.
Default instruction text
By default, the password reset screen shows the following guidance:
- Your password must be at least X characters long.
- Your password should not be easy to guess.
- Use characters from at least 3 of the following categories:
- Uppercase letters, for example A–Z
- Lowercase letters, for example a–z
- Numbers, for example 0–9
- Symbols, for example ! @ # $
In this text, X is derived from the Active Directory environment.
How Activate determines which instruction text to show
Activate resolves the password instruction text in the following order:
- User rules override Activate first checks for instructions defined in the user rules, using the PasswordResetQuestions parameter under Tasks > Passwords.
- Localised resource string If no user rule instructions are defined, Activate then checks the passwords/instructions string in the en language resource.
- Hard-coded fallback If neither of the above is available, Activate falls back to the built-in default instruction text.
This means administrators can override the text without changing code, but if no configured value exists, users will still see the default guidance.
Where the minimum length comes from
The minimum password length shown to the user is based on the password reset information read from Active Directory. In practice, Activate reads the minimum password length from the domain password settings and uses that value when building the default instruction text. Based on the controller behaviour you provided, this is sourced from the password reset information available for the current user context.
Suggested note for admins
If a customer reports that the password reset instructions are incorrect, first confirm whether:
- the instruction text has been overridden in Tasks > Passwords
- a localised passwords/instructions value is present
- the environment uses fine-grained password policies that differ from the default domain policy