Solved

NOT able to change password when user are being promted that there password has exptred

Posted on 2003-11-26
10
833 Views
Last Modified: 2013-12-04
"you don`t have permission to change your password".

It only happens when there passwords are expiring an dbeing pronpted to change if you change the password without expiration notification it works

Any ideas why this would happen?
0
Comment
Question by:NaveedAnwar
  • 3
  • 3
  • 3
  • +1
10 Comments
 
LVL 5

Expert Comment

by:juliancrawford
ID: 9827342
It sounds like a group policy setting would be doing this - are the users affected all part of the same group?
0
 
LVL 41

Accepted Solution

by:
graye earned 500 total points
ID: 9828772
I've seen this happen before... in a mixed-mode domain after we "hardened" the servers.

Yes it's a bit strange, since there is a catch22.   After a user types in their UserID and Password, they are immediately prompted with a "it's about to expire, would you like to change it now" message.  However, the user hasn't really been fully authenticated at this point.  So, no... they don't have permission to change their password (because they can't enumerate the list of users on the domain anoymously like they did before the hardending).

The solution is to tell your users to ignore that prompt, and only after they're completely logged in, do the CTRL-ALT-DEL and press the "change password" button.  (Either that, or relax security a bit)

We've tried to figure out how to stop that message from poping up... but we gave up.
0
 
LVL 37

Expert Comment

by:Bing CISM / CISSP
ID: 9832620
if you did not apply latest service pack to the windows 2000 server, i think the problem should be caused a bug of the operating system. anyway, the bug has been fixed. for more information, please refer the MSKB article at:

Kerberos Change Password Does Not Work When Account Password Expires
http://support.microsoft.com/?id=kb;en-us;253532

additionally, there are other two similar articles for your reference too:

"The Password Cannot Be Changed at This Time" Error Message When You Try to Change a User's Password
http://support.microsoft.com/?id=kb;en-us;273004

User May Not Be Able to Change Their Password If You Configure the 'User Must Change Password at Next Logon' Setting
http://support.microsoft.com/?id=kb;en-us;320325

hope it helps,
bbao
0
 
LVL 1

Expert Comment

by:NetwerkMerc
ID: 9849546
I agree that it sounds like GP or local system policy.  Minimum password lifespan vs expiration reminder...things like that

-Or-

Check that the user (i.e. "self") can change their password.   Shounds like it is explicitly denied.  AD users and computers->users-> right-click properties on "username"->Security tab->under "groups or user name" look for "SELF" and check the change password permission below.  It is either explicitly denied or implicitly denied via inheritance.

-Eric
Security and Virus forum moderator at ComputerRepair.com
<edited by YensidMod>
0
 
LVL 41

Expert Comment

by:graye
ID: 9849968
This is more common that you might think in a mixed-mode domain...  where the account policies in WinNT apply
0
What Security Threats Are You Missing?

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

 
LVL 37

Expert Comment

by:Bing CISM / CISSP
ID: 9849988
graye, o? how to solve it then?
0
 
LVL 41

Expert Comment

by:graye
ID: 9850013
We've found no solution (other than what I described above... teach the users to ignore that prompt and change their password only after they're completely logged in).

BTW:  NaveedAnwar hasn't confirmed that he's runing a WinNT-Win2k mixed-mode domain (so I might be completely off)
0
 
LVL 1

Expert Comment

by:NetwerkMerc
ID: 9850391
I know by default in a 2003 native, a "blank" use by default cannot change their password.  Not through specific account settings, rather security on the user object.  If it is mixed, most auth. request try to make use of 2k, if there is an explicit deny 2k will NOT query NT4, becuase it already has an explicit answer.  If the clients are NT4, the directory services client NEEDS to be installed and appropriate logon policy needs to be configured (ie NTLM) as well.  Once everyone is loggin in fine, you can look at tightening auth. methods, forcing kerberos, more restrictive account, user, group policies.  If there is little invested in policies, try scraping them.  But this is permission or policy caused.

dcgpofix /both

-Eric
Security and Virus forum moderator at ComputerRepair.com
<edited by YensidMod>
 
0
 
LVL 37

Expert Comment

by:Bing CISM / CISSP
ID: 9895548
a lot of users complain similar problems like what this question described, maybe caused by simiar reasons...
NaveedAnwar, how are things?
0
 
LVL 1

Expert Comment

by:NetwerkMerc
ID: 10249820
Is this thing on?  Please reply or close the topic.

-Eric
0

Featured Post

Highfive Gives IT Their Time Back

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

Security measures require Windows be logged in using Standard User login (not Administrator).  Yet, sometimes an application has to be run “As Administrator” from a Standard User login.  This paper describes how to create a shortcut icon to launch a…
OfficeMate Freezes on login or does not load after login credentials are input.
This video discusses moving either the default database or any database to a new volume.
This video shows how to remove a single email address from the Outlook 2010 Auto Suggestion memory. NOTE: For Outlook 2016 and 2013 perform the exact same steps. Open a new email: Click the New email button in Outlook. Start typing the address: …

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now