Oracle 12c – How to Determine if Users Have Default Password

oracleoracle-12c

I know that I can query the "dba_users_with_defpwd" table, but I've seen reports that for some accounts (mainly SYS and SYSTEM) even if you provide a new non-trivial password during install, they will be shown as having the default password.

Is there any way to verify the users with default passowrds other than manually comparing the "sys.users$" and "sys.defalut_pwd$" tables?

NOTE: I don't have direct access to the environment, I just receive the user tables to check for compliance with the company's rules.

Best Answer

SYS and SYSTEM accounts are incorrectly listed in DBA_USERS_WITH_DEFPWD in 12c (Doc ID 2173962.1)

SYS and SYSTEM have that flag set a database create time, and the flag doesn't clear until the first password change AFTER the database is created. So it may or may not be a default password, but it if it isn't default, it's one that hasn't been changed since the database was created and therefore should be changed.

If you do not have access to this, then:

https://mandysandhu.com/2017/10/20/oracle-12c-syssystem-accounts-are-incorrectly-listed-in-dba_users_with_defpwd/

Related Question