Knowledgebase: Android with TouchDown
TouchDown allows you to update the password without providing the existing password (prior to v6.1.0007)
Posted by Donna Magada on 24 February 2010 02:40 PM

TouchDown does prompt for the existing password before letting you change it - when an IT policy is forcing the password change.

However, TouchDown does not prompt for the existing password when you manually choose to change it. With TouchDown v6.1.0007, the device does now prompt for existing password in this scenario.

Of course, if the Inactivity Timeout lock has been imposed, an unauthorized user could not access the 'Change PIN' option.  It is only when the device is not locked that this is an issue.  It is therefore advisable to set a lower Inactivity Timeout interval.