<div>
User logs on using a local username/password, or using their cached password (whatever it was before it was reset at corporate. If the user forgets their domain password, they will need to log in using a local username/password, full stop - they need -some- way to authenticate to the local workstation.)<br />
<br />
User connects to VPN.<br />
<br />
Once VPN connection takes place, user presses CTRL-ALT-DEL and uses the Change Password button to establish a new Active Directory password.<br />
<br />
User can then log in using new AD password.<br />
<br />

</div>


<div>
in addition, you can try configure user's Connectivity VPN Client &nbsp;to &quot;connect before logon&quot;. This way user can logon to VPN before logging on to Windows. Also, some company have a local regular user account created on every computer in case they don't have access and cannot logon locally to their laptop and you don't wish to share the password with the end users about the local admin account password.
</div>


<div>
The solution will work if they know the &quot;old&quot; password when pressing control-alt-delete - what if they forgot their old password? How do we reset it then?
</div>


<div>
The only other option is to have them come back to the main office or another remote site which has connectivity to your AD infrastructure. Once the computer is plugged in on the LAN it will pick up the newly changed password. <br />
<br />
Short of that there is no other way. 
</div>


<div>
Otherwise, configured the Connectivity VPN client in the mode of &quot;Connect Before logon&quot;. This way it will be connect to your network.
</div>


<div>
OK - so assuming they forget the password, we reset it, they login locally, vpn in, change password (use our new password as old password) - they log out and login with new password (not vpn'd in), does the cache get updates with new password?
</div>


<div>
while vpn is established, have the user logoff and log back in with your reset password. It will cache and all set to go until he or she forgets the new password.
</div>


<div>
Our VPN solution doesn't allow for actvation befoe windows logon - so if they log off, it will terminate the vpn session.
</div>


<div>
even if you logon to the workstation with a local account, then established vpn connection and logoff, your VPN connection still connected. While still connected, logging on is like at your office as the vpn still connected. So the user should be able to logon with the new password you have reset for them and should work...
</div>


<div>
I dont think that will work as when you logoff part of the process is &quot;closing network connections&quot; this will undoubtably kill the VPN sessions. 
</div>


<div>
Have you tried? it always work for me, logging off does not kill your VPN connection. otherwise it wont' have those features such as &quot;Connect before logon&quot; and &quot;Logoff on Connect&quot;. Both features are either connect to VPN before logging on or Logoff once you established the VPN session. Think about it, why logff once you connected VPN, because it simulate the real logon process like where you are at work.<br />
So, for you to manually logon on as a local users, establised to VPN, log off so the you can logon to the domain. That is the main purpose of those feature, whether you configured it automatically does the real logon or manually.
</div>


<div>
Our VPN solution (Netscaler SSLVPN) does not provide that option (connect before logon etc).
</div>


<div>
I thought you have CISCO VPN client as stated on your description of the question. &nbsp;May be I was reading it differently...
</div>


<div>
Yes, we have that as an option - but not for production use.
</div>


<div>
May be you should consider using it as we have been using Cisco VPN client for over a decades now.
</div>


<div>
<div class="content wysiwyg-content">
We are going to roll out 100 remote users running Windows XP - we want these machines in our corporate AD tree so they get GPO's populated to them..these individuals connect to corporate via Netscaler SSLVPN. Questions is this - assuming the user forget his/her workstation domain password - if we reset it from corporate, the changes won't get to them because they are not on VPN (they can't login to launch VPN) - what do companies do in this scenario? We also have Cisco VPN client as an option...thoughts/ideas appreciated.
</div>
</div>


We are going to roll out 100 remote users running Windows XP - we want these machines in our corporate AD tree so they get GPO's populated to them..these individuals connect to corporate via Netscaler SSLVPN. Questions is this - assuming the user forget his/her workstation domain password - if we reset it from corporate, the changes won't get to them because they are not on VPN (they can't login to launch VPN) - what do companies do in this scenario? We also have Cisco VPN client as an option...thoughts/ideas appreciated.

How to reset password for telecommuter XP machine in AD domain, while not VPN'd in (SSL VPN)

Active Directory (AD) is a Microsoft brand for identity-related capabilities. In the on-premises world, Windows Server AD provides a set of identity capabilities and services, and is hugely popular (88% of Fortune 1000 and 95% of enterprises use AD). This topic includes all things Active Directory including DNS, Group Policy, DFS, troubleshooting, ADFS, and all other topics under the Microsoft AD and identity umbrella.

Active Directory

NetScaler is the industry’s leading web and application delivery controller that maximizes the performance and availability of all applications and data, and also provide secure remote access to any application from any device type. NetScaler products are easily selected by determining the edition providing functional needs and the appropriate physical or virtual appliance platform to fulfill performance needs.