From: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Date: Sun, 2 Mar 2025 00:59:19 +0000 (+1300)
Subject: manpages:samba-tool: separate passwordsettings set/show
X-Git-Tag: tevent-0.17.0~541
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=73bc0a406ce9cec186bc6b9e539ad8498c07c713;p=thirdparty%2Fsamba.git

manpages:samba-tool: separate passwordsettings set/show

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Rowland Penny <rpenny@samba.org>
---

diff --git a/docs-xml/manpages/samba-tool.8.xml b/docs-xml/manpages/samba-tool.8.xml
index 0581532af7f..8014e8bf204 100644
--- a/docs-xml/manpages/samba-tool.8.xml
+++ b/docs-xml/manpages/samba-tool.8.xml
@@ -2323,8 +2323,74 @@
 </refsect3>
 
 <refsect3>
-	<title>domain passwordsettings <replaceable>show|set</replaceable> <replaceable>options</replaceable> [options]</title>
-	<para>Show/set password settings.</para>
+	<title>domain passwordsettings set <replaceable>options</replaceable> [options]</title>
+
+	<para>Set password settings, including complexity
+	requirements, lockout policy, history length, minimum password
+	length, and minimum and maximum password age on a Samba AD DC
+	server.</para>
+
+	<para>Use against a Windows DC is possible, but group policy will override it.
+	</para>
+
+<variablelist>
+	  <varlistentry>
+	    <term>-H URL, --URL=URL</term>
+	    <listitem><para>LDB URL for database or target server</para></listitem>
+	  </varlistentry>
+	  <varlistentry>
+	    <term>-q, --quiet</term>
+	    <listitem><para>Be quiet</para></listitem>
+	  </varlistentry>
+	  <varlistentry>
+	    <term>--complexity=COMPLEXITY</term>
+	    <listitem><para>The password complexity (on | off | default). Default is 'on'</para></listitem>
+	  </varlistentry>
+	  <varlistentry>
+	    <term>--store-plaintext=STORE_PLAINTEXT</term>
+	    <listitem><para>Store plaintext passwords where account have 'store passwords with reversible encryption' set (on | off | default). Default is 'off'</para></listitem>
+	  </varlistentry>
+	  <varlistentry>
+	    <term>--history-length=HISTORY_LENGTH</term>
+	    <listitem><para>The password history length (<replaceable>integer</replaceable> | default).  Default is 24.</para></listitem>
+	  </varlistentry>
+	  <varlistentry>
+	    <term>--min-pwd-length=MIN_PWD_LENGTH</term>
+	    <listitem><para>The minimum password length (<replaceable>integer</replaceable> | default).  Default is 7.</para></listitem>
+	  </varlistentry>
+	  <varlistentry>
+	    <term>--min-pwd-age=MIN_PWD_AGE</term>
+	    <listitem><para>The minimum password age (<replaceable>number of days</replaceable> | default).  Default is 1.</para></listitem>
+	  </varlistentry>
+	  <varlistentry>
+	    <term>--max-pwd-age=MAX_PWD_AGE</term>
+	    <listitem><para>The maximum password age (<replaceable>number of days</replaceable> | default).  Default is 43.</para></listitem>
+	  </varlistentry>
+	  <varlistentry>
+	    <term>--account-lockout-duration=ACCOUNT_LOCKOUT_DURATION</term>
+	    <listitem><para>The length of time an account is locked out after exceeding the limit on bad password attempts (<replaceable>number of minutes</replaceable> | default).  Default is 30 mins.</para></listitem>
+	  </varlistentry>
+	  <varlistentry>
+	    <term>--account-lockout-threshold=ACCOUNT_LOCKOUT_THRESHOLD</term>
+	    <listitem><para>The number of bad password attempts allowed before locking out the account (<replaceable>integer</replaceable> | default).  Default is 0 (never lock out).</para></listitem>
+	  </varlistentry>
+	  <varlistentry>
+	    <term>--reset-account-lockout-after=RESET_ACCOUNT_LOCKOUT_AFTER</term>
+	    <listitem><para>After this time is elapsed, the recorded number of attempts restarts from zero (<replaceable>integer</replaceable> | default).  Default is 30.</para></listitem>
+	  </varlistentry>
+</variablelist>
+</refsect3>
+
+<refsect3>
+	<title>domain passwordsettings show <replaceable>options</replaceable> [options]</title>
+	<para>Display current password settings for the domain.</para>
+
+	<variablelist>
+	  <varlistentry>
+	    <term>-H URL, --URL=URL</term>
+	    <listitem><para>LDB URL for database or target server</para></listitem>
+	  </varlistentry>
+	</variablelist>
 </refsect3>
 
 <refsect3>