We are trying to implement a Universal Password policy for users on our system running OES 2015 SP1, ZCM 2017 and AD. We set up Universal Password to use Challenge/Response questions and then to provide a password hint. Here are a couple of things that I hope there are work arounds for.

1. When the password change dialog comes up, there is minimal info on what the criteria are for a valid password. You can put in an administrator message in but the user has to know to click on the 'policy' button on the change password dialog to see it, which is not very intuitive. Even then the Administrator message is at the bottom of the policy dialog and not very prominent.

2. When changing a password, you are asked to put in the password hint on the password change dialog (which happens at the end of the login) and after that you are prompted to put in the password hint again in a separate dialog. Why are you prompted twice for the password hint?

3. You can put in nothing for the password hint. Wouldn't you want to force users to put in something? However, it looks like you will be prompted every time you login for a password hint if you leave it blank.

4. You can change the Challenge/Response questions without changing the password. Can you change the password hint without changing the password? For instance, if you decided the password hint you entered was not clear enough and wanted to redo it but didn't want to change your actual password.