Cisco ASA Series Cli Configuration Manual page 1665

Chapter 1 Configuring Connection Profiles, Group Policies, and Users
Figure 1-3
Note
Using Active Directory to Override an Account Disabled AAA Indicator
To override an account-disabled indication from a AAA server, use the override-account-disable
command in tunnel-group general-attributes configuration mode on the ASA and perform the following
steps under Active Directory.
Note
Allowing override account-disabled is a potential security risk.
Step 1
Select Start > Programs > Administrative Tools > Active Directory Users and Computers.
Step 2
Right-click Username > Properties > Account and select Disable Account from the menu.
Active Directory—Maximum Password Age
The radius-with-expiry command, formerly configured as part of tunnel-group remote-access
configuration to perform the password age function, is deprecated. The password-management
command, entered in tunnel-group general-attributes mode, replaces it.
Configuring Connection Profiles
Cisco ASA Series CLI Configuration Guide
1-31