User should be required to change temporary password
If a temporary password is set by the administrator or is sent to the user, there should be an option to force the initial password to expire when on first use and force the user to set the password.
17
votes

-
ChrisH commented
+1: include the new user scenario