Release Notes                 



IBM® Security® Identity Manager  

Desktop Password Reset Assistant (DPRA)

























Version 7.0.11

This edition applies to version 7.0 of IBM Security Identity Manager and to all subsequent releases and modifications until otherwise indicated in new editions.

Copyright International Business Machines Corporation 2003, 2016. All rights reserved.
US Government Users Restricted Rights -- Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.



Preface. 3

Component Features and Purpose. 3

Contents of this Release. 4

Component Version. 4

New Features. 5

Closed Issues. 6

Known Issues. 8

Installation and Configuration Notes. 9

Configuration Notes. 14

Troubleshooting. 14

Supported Configurations. 15

Installation Platform.. 15

Notices. 16

Trademarks. 18


Welcome to the IBM Security Identity Manager Desktop Password Reset Assistant


These Release Notes contain information for the following products that was not available when the IBM Security Identity Manager manuals were printed:




Component Features and Purpose

The Desktop Password Reset Assistant (DPRA) software allows a Windows user to perform self-service password resets and self-service unlocks from their workstation.  The DPRA software performs these functions even if the user has forgotten their Windows password and is unable to log in to their Windows account on their workstation.


The DPRA is distributed as a Credential Provider module and is easily installed on the user’s Windows login desktop.


The DPRA software provides the following benefits:


ü  Self-service password change and synchronization of all accounts

ü  Self-service Windows password unlock without a password change

ü  Self-service password reset (generated password) emailed to you and configured contact

ü  Authentication via secure Challenge/Response features of Identity Manager

ü  Translated user interface and support for double-byte languages

ü  Customizable UI with support for company logos and backgrounds

ü  Installation via GUI installer

ü  Optional integration with TAM ESSO through TAM ESSO Assistant

ü  Compatible with deployment tools such as Tivoli Provisioning Manager or Microsoft SMS

Contents of this Release

Component Version



Release Date

2016 June 07 15.28.01

Assistant Version


Component Versions



Identity Manager Desktop Password Reset Assistant Installation and User.

Available at the IBM Security Identity Manager Information Center



New Features

Enhancement # (FITS)




Items included in 7.0.11 release


40136 (80676)

39417 (78542)


Desktop Password Reset Assistant - Unlock option only to show windows accounts


30316 (55937)


GINA reset entered text on wrong answers




Added support for TLS 1.1 and 1.2



Items included in 6.0.10 release




Allow limiting the languages displayed in the language drop down.




Add registry value to disable the account selection screen when password synch is enabled




Add registry value to disable the account unlock option




DPRA accessibility – Language dropdown




DPRA accessibility – Select accounts list




DPRA accessibility – Top navigation



Items included in 6.0.9 release




Added Turkish language string table



Items included in 6.0.6 release




Color contrast issue




Provide a text area on DPRA screen for user instructions




French DRPA displays error codes in English



Items included in 6.0.5 release




Identify Yourself text is misaligned



Items included in 6.0.4 release




Added support for “unlock only” when password synchronization is enabled on the ISIM server




Added timeout capability.  Defaults to 1 minute.  Set to custom value with registry value “TimeoutMS” in milliseconds




Updated account selection to remove radio buttons for selecting all accounts and added a checkbox to the column header to select/unselect all.




Added updated version number to installer package to show correct version number in Windows control panel



Items included in 6.0.3 release


Added support for custom string files in multiple languages.  The file names used for the language specific files are “DPRA_str_xx.txt”, where “xx” is the language identifier.  If no language specific file is found, the DPRA will still look for DPRA_str.txt.


Closed Issues



PMR# / Description




Items closed in 7.0.11 version



Fixed stack overflow crash on 32 bit systems





Items closed in 6.0.10 version



DPRA Turkish keyboard cannot be set




DPRA on French Windows pc shows English label




Unexpected back button behavior in DPRA








Items closed in 6.0.9 version



DPRA Accessibility - JAWS doesn't read language dropdown value.





Items closed in 6.0.8 version



DPRA keyboard layout changes French > English




French link sometimes displays for English workstation




On DPRA 6.0.7 DPRA is a beta drop, customer is observing accessibility issues with error pop-up box not taking focus.





Items closed in 6.0.7 version



DPRA on French Windows switches keyboard layout to English.




DPRA doesn't take focus from locked Windows screen and DPRA doesn't check for other instances of itself..




DPRA - Status bar messages disappear after popup message box.





Items closed in 6.0.6 version



DPRA on French Windows PC shows English Label on first start.





Items closed in 6.0.5 version



DPRA Back button doesn't work as expected.





Items closed in 6.0.4 version



The word “Static” shows in the background in the upper left corner of DPRA dialog




Unexpected results of accounts selection page if going back to the page/view in DPRA




Submit button disabled after clicking Back and Next




Duplicate credential in Remote Desktop window




DPRA splash screen does not translate "Answer" word  





Items closed in 6.0.3 version



DPRA Template file not matching up with the documentation




When “All Accounts” is selected during DPRA password reset, this is changing password of more than just displayed AD and Windows accounts







Known Issues



PMR# / Description




Installation on German OS Versions

If the installer language is set to Deutsch, the DPRA installer may not properly display the text entry box required for entry of the IP address of the ITIM server. Depending on the default font size, the text box may be pushed off the right edge of the form.


This issue affects only the installation of DPRA.  The end user operation in Deutsch is not affect.





Strings not Translated

The following strings have been added to this release and have not been translated from English. The work-around is to manually translate and replace the string in DPRA_str.txt as described in the “Customizing the UI Strings” section of this document.


10009   "Challenge/Response not configured for this user"

20024   "Unlock account request successfully issued to ITIM"

20025   "Unlock request failed"




Security Note


The DPRA now clears all responses when revisiting the challenges.  If an incorrect response is giving you are returned to the start screen and must enter the user ID again.  This was done for security purposes.

Corrections to User Guide


Chapter 4


The following text is incorrect.


“Your options depend on whether password synchronization is enabled or disabled.  If enabled, you see only your Windows accounts and the Unlock only button is enabled.  If password synchronization is disabled, the Unlock only button is disabled.  Your choice is to enter a new password.”


The opposite is true.  When password synchronization is disabled, you will have the option to Unlock only.  When password synchronization is enabled, the Unlock only option is disabled.




Change to Unlock functionality


The unlock functionality has been moved to the account selection screen.  When you check the “Unlock selected accounts” checkbox, the “Next” button will change to “Submit”.  Clicking “Submit” will issue unlock requests to the selected accounts and DPRA will close.


The password screen now only has fields for entering the new password.




Change to registry configuration


The following configuration items have been added:


Inactivity Timeout

You can configure the amount of time the DPRA remains inactive before it times out and closes itself.  The value is given in milliseconds.  By default, the inactivity timeout is 60000 milliseconds ( 1 minute ).


Table 8. TimeoutMS string details








Keyboard mapping

When you select a different language, the DPRA will load the associated keyboard map for that language.  This key allows you to disable the keyboard mapping.  If this is set to true, when a new language is selected, only the text associated with that language is used and the keyboard mapping is not changed.


Table 8. NoKeyboardMapping string details








Allow selected unlock requests when Password Synch is enabled

When password synchronization is enabled on the ISIM server, you will only have the option to set a new password for all of the accounts owned by the ISIM user.  The “Unlock selected accounts” option is not shown.  This setting allows you to select accounts to be unlocked even if password synchronization is enabled on the ISIM server.  Note that this is only valid for Windows accounts.  Since all accounts are shown when password synchronization is enabled, there may be non-Windows accounts displayed.  Attempting to unlock a non-Windows account will result in an internal error response from the ISIM server.


Table 8. AllowPasswordSynchUnlock string details








Skip account selection when password synchronization is enabled

This setting allows you to skip the account selection screen when password synchronization is enabled.  When password synchronization is enabled all accounts are automatically selected.  The account selection screen is only informational to allow you to see which accounts will be affected.  To simplify password resets for end users, this screen can be skipped when password synchronization is enabled by setting this to false.


Table 8. AllowPasswordSynchUnlock string details








Disable account unlock function

This setting allows you to disable the account unlock function.  The checkbox for selecting account unlock is not displayed.  Only password resets are allowed.  The Windows Active Directory Adapter can be configured to automatically issue an account unlock when passwords are changed.


Table 8. AllowPasswordSynchUnlock string details











Custom Bitmaps

Starting with version 6.0.10, the DPRA is now implemented as a property sheet wizard.  This has affected the title bitmap images.  The title bitmap should be 48 x 552 pixels.  On Windows 8.1 and Windows 10, the dialog is rendered with different dimensions.  On those systems the title bitmap should be 39 x 449 pixels.  The customization examples have been updated with sample bitmaps.  DPRA_title.bmp ( 48 x 552) and DPRA_title_small.bmp ( 39 x 449 ).

Supported Languages

Starting with version 6.0.10, the list of languages in the language selection list only contains languages that have the corresponding dll file installed in system32.  By default all supported languages are installed.  If you wish to limit the languages shown in the language list, you can simply remove the language dll files from system32.  The language file names are in the format ItimCR_xx.dll, where ‘xx’ is the two letter code for the language.

Installation and Configuration Notes

See the IBM Security Desktop Password Reset Assistant Installation Guide for detailed instructions.




Configuration Notes

The following configuration notes apply to this release:



See the IBM Security Desktop Password Reset Assistant Installation Guide for detailed instructions.



Warning or error message

Recommended Action

Internal error on ISIM sever- OPERATION_NOT_ALLOWED

Ensure that user has privilege in order to unlock their accounts without password change. Either create new ACI (or modify existing) that has a permission for "Account Locked out". To verify this explore Set System Security --> Change Access Control Items --> Permissions.


Supported Configurations

Installation Platform

The IBM Security Identity Manager Desktop Password Reset Assistant was built and tested on the following product versions.


Assistant Installation Platform: 

Installable on the 32 or 64-bit versions of the following Operating systems on x86 or x64 compatible CPU:


Windows 7

Windows 2008 

Windows 2008 R2

Windows 8.x

Windows 2012

Windows 10



Managed Resource:




IBM Security Identity Manager:

Identity Manager 6.0

Identity Manager 7.0





This information was developed for products and services offered in the U.S.A. IBM may not offer the products, services, or features discussed in this document in other countries. Consult your local IBM representative for information on the products and services currently available in your area. Any reference to an IBM product, program, or service is not intended to state or imply that only that IBM product, program, or service may be used. Any functionally equivalent product, program, or service that does not infringe any IBM intellectual property right may be used instead. However, it is the user's responsibility to evaluate and verify the operation of any non-IBM product, program, or service.

IBM may have patents or pending patent applications covering subject matter described in this document. The furnishing of this document does not give you any license to these patents. You can send license inquiries, in writing, to:

IBM Director of Licensing

IBM Corporation

North Castle Drive

Armonk, NY  10504-1785  U.S.A.


For license inquiries regarding double-byte (DBCS) information, contact the IBM Intellectual Property Department in your country or send inquiries, in writing, to:


IBM World Trade Asia Corporation


2-31 Roppongi 3-chome, Minato-ku

Tokyo 106-0032, Japan


The following paragraph does not apply to the United Kingdom or any other country where such provisions are inconsistent with local law: INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Some states do not allow disclaimer of express or implied warranties in certain transactions, therefore, this statement may not apply to you.


This information could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the publication. IBM may make improvements and/or changes in the product(s) and/or the program(s) described in this publication at any time without notice.


Any references in this information to non-IBM Web sites are provided for convenience only and do not in any manner serve as an endorsement of those Web sites. The materials at those Web sites are not part of the materials for this IBM product and use of those Web sites is at your own risk.


IBM may use or distribute any of the information you supply in any way it believes appropriate without incurring any obligation to you.


Licensees of this program who wish to have information about it for the purpose of enabling: (i) the exchange of information between independently created programs and other programs (including this one) and (ii) the mutual use of the information which has been exchanged should contact:


IBM Corporation


11400 Burnet Road

Austin, TX 78758  U.S.A.

Such information may be available, subject to appropriate terms and conditions, including in some cases, payment of a fee.


The licensed program described in this information and all licensed material available for it are provided by IBM under terms of the IBM Customer Agreement, IBM International Program License Agreement, or any equivalent agreement between us.


Any performance data contained herein was determined in a controlled environment. Therefore, the results obtained in other operating environments may vary significantly. Some measurements may have been made on development-level systems and there is no guarantee that these measurements will be the same on generally available systems. Furthermore, some measurements may have been estimated through extrapolation. Actual results may vary. Users of this document should verify the applicable data for their specific environment.


Information concerning non-IBM products was obtained from the suppliers of those products, their published announcements or other publicly available sources. IBM has not tested those products and cannot confirm the accuracy of performance, compatibility or any other claims related to non-IBM products. Questions on the capabilities of non-IBM products should be addressed to the suppliers of those products.



The following terms are trademarks or registered trademarks of International Business Machines Corporation in the United States, other countries, or both:

IBM logo

Adobe, Acrobat, Portable Document Format (PDF), and PostScript are either registered trademarks or trademarks of Adobe Systems Incorporated in the United States, other countries, or both.

Cell Broadband Engine and Cell/B.E. are trademarks of Sony Computer Entertainment, Inc., in the United States, other countries, or both and is used under license therefrom.



Java and all Java-based trademarks are trademarks of Sun Microsystems, Inc. in the United States, other countries, or both.



Microsoft, Windows, Windows NT®, and the Windows logo are trademarks of Microsoft Corporation in the United States, other countries, or both.


Intel®, Intel logo, Intel Inside®, Intel Inside logo, Intel Centrino™, Intel Centrino logo, Celeron®, Intel Xeon™, Intel SpeedStep®, Itanium®, and Pentium® are trademarks or registered trademarks of Intel Corporation or its subsidiaries in the United States and other countries.


UNIX is a registered trademark of The Open Group in the United States and other countries.


Linux is a trademark of Linus Torvalds in the U.S., other countries, or both.


ITIL® is a registered trademark, and a registered community trademark of the Office of Government Commerce, and is registered in the U.S. Patent and Trademark Office.


IT Infrastructure Library® is a registered trademark of the Central Computer and Telecommunications Agency which is now part of the Office of Government Commerce.


Other company, product, and service names may be trademarks or service marks of others.


End of Release Notes