Go Premium for a chance to win a PS4. Enter to Win

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 856
  • Last Modified:

NOT able to change password when user are being promted that there password has exptred

"you don`t have permission to change your password".

It only happens when there passwords are expiring an dbeing pronpted to change if you change the password without expiration notification it works

Any ideas why this would happen?
0
NaveedAnwar
Asked:
NaveedAnwar
  • 3
  • 3
  • 3
  • +1
1 Solution
 
juliancrawfordCommented:
It sounds like a group policy setting would be doing this - are the users affected all part of the same group?
0
 
grayeCommented:
I've seen this happen before... in a mixed-mode domain after we "hardened" the servers.

Yes it's a bit strange, since there is a catch22.   After a user types in their UserID and Password, they are immediately prompted with a "it's about to expire, would you like to change it now" message.  However, the user hasn't really been fully authenticated at this point.  So, no... they don't have permission to change their password (because they can't enumerate the list of users on the domain anoymously like they did before the hardending).

The solution is to tell your users to ignore that prompt, and only after they're completely logged in, do the CTRL-ALT-DEL and press the "change password" button.  (Either that, or relax security a bit)

We've tried to figure out how to stop that message from poping up... but we gave up.
0
 
bbaoIT ConsultantCommented:
if you did not apply latest service pack to the windows 2000 server, i think the problem should be caused a bug of the operating system. anyway, the bug has been fixed. for more information, please refer the MSKB article at:

Kerberos Change Password Does Not Work When Account Password Expires
http://support.microsoft.com/?id=kb;en-us;253532

additionally, there are other two similar articles for your reference too:

"The Password Cannot Be Changed at This Time" Error Message When You Try to Change a User's Password
http://support.microsoft.com/?id=kb;en-us;273004

User May Not Be Able to Change Their Password If You Configure the 'User Must Change Password at Next Logon' Setting
http://support.microsoft.com/?id=kb;en-us;320325

hope it helps,
bbao
0
Threat Trends for MSPs to Watch

See the findings.
Despite its humble beginnings, phishing has come a long way since those first crudely constructed emails. Today, phishing sites can appear and disappear in the length of a coffee break, and it takes more than a little know-how to keep your clients secure.

 
NetwerkMercCommented:
I agree that it sounds like GP or local system policy.  Minimum password lifespan vs expiration reminder...things like that

-Or-

Check that the user (i.e. "self") can change their password.   Shounds like it is explicitly denied.  AD users and computers->users-> right-click properties on "username"->Security tab->under "groups or user name" look for "SELF" and check the change password permission below.  It is either explicitly denied or implicitly denied via inheritance.

-Eric
Security and Virus forum moderator at ComputerRepair.com
<edited by YensidMod>
0
 
grayeCommented:
This is more common that you might think in a mixed-mode domain...  where the account policies in WinNT apply
0
 
bbaoIT ConsultantCommented:
graye, o? how to solve it then?
0
 
grayeCommented:
We've found no solution (other than what I described above... teach the users to ignore that prompt and change their password only after they're completely logged in).

BTW:  NaveedAnwar hasn't confirmed that he's runing a WinNT-Win2k mixed-mode domain (so I might be completely off)
0
 
NetwerkMercCommented:
I know by default in a 2003 native, a "blank" use by default cannot change their password.  Not through specific account settings, rather security on the user object.  If it is mixed, most auth. request try to make use of 2k, if there is an explicit deny 2k will NOT query NT4, becuase it already has an explicit answer.  If the clients are NT4, the directory services client NEEDS to be installed and appropriate logon policy needs to be configured (ie NTLM) as well.  Once everyone is loggin in fine, you can look at tightening auth. methods, forcing kerberos, more restrictive account, user, group policies.  If there is little invested in policies, try scraping them.  But this is permission or policy caused.

dcgpofix /both

-Eric
Security and Virus forum moderator at ComputerRepair.com
<edited by YensidMod>
 
0
 
bbaoIT ConsultantCommented:
a lot of users complain similar problems like what this question described, maybe caused by simiar reasons...
NaveedAnwar, how are things?
0
 
NetwerkMercCommented:
Is this thing on?  Please reply or close the topic.

-Eric
0

Featured Post

Automating Your MSP Business

The road to profitability.
Delivering superior services is key to ensuring customer satisfaction and the consequent long-term relationships that enable MSPs to lock in predictable, recurring revenue. What's the best way to deliver superior service? One word: automation.

  • 3
  • 3
  • 3
  • +1
Tackle projects and never again get stuck behind a technical roadblock.
Join Now