Do not store administrator credentials in configuration file; this is what multiple users in database are for
Add AccountLocked and ForcePasswordChange columns for User
Implemented password resetting for tenant administrators