Prevent users in XP from changing network password

[gshurman]

One of our users just showed me that they could change their network login password by pressing Ctrl-Alt-Del in XP and click on Change Password. Server OS is Windows 2003 R2 and Active Directory has the user accounts marked with "user cannot change password". What am I missing here? Is something in Group Policy allowing this?

 

[Davetoo]

Are the users logging on via network credentials or local credentials? If network, was he actually able to change his password?

I'm Certifiable, not cert-ified.
It just means my answers are from experience, not a book.

There are no more PDC's! There are DC's with FSMO roles!

 

[gshurman]

Logging in with network credentials.

 

[Davetoo]

...and the rest of my question...?

I'm Certifiable, not cert-ified.
It just means my answers are from experience, not a book.

There are no more PDC's! There are DC's with FSMO roles!

 

[gshurman]

Not just one user, but any of over 100 users on the network.

 

[pagy]

Could the user actually change the password though?? Just having the option 'Change Password' available after pressing ctrl atl del does not mean that they can actually change it

Paul
MCSE 2003
MCSA 2003
MCITP Enterprise Administrator

If there are no stupid questions, then what kind of questions do stupid people ask? Do they get smart just in time to ask questions?
Scott Adams

 

[Davetoo]

As pagy has reiterated...the question to be answered is was the user or users actually able to change their password? Not just have the option...did they change their password, log off the system, and then log back on the system with that new password using their network USERID?

I'm Certifiable, not cert-ified.
It just means my answers are from experience, not a book.

There are no more PDC's! There are DC's with FSMO roles!

 

[gshurman]

Yes, they enter their current network password and then enter a new one and verify it, They are even told that the new password cannot be the same as any of the 24 previous ones.

 

[Davetoo]

And then they can logon to their computer using their network credentials with the changed password?

It really would save time if you'd answer both parts to the questions we ask...

I'm Certifiable, not cert-ified.
It just means my answers are from experience, not a book.

There are no more PDC's! There are DC's with FSMO roles!

 

[gshurman]

Yes, after making the change they can login to the network with their new password. The old password can no longer be used. The new password is also being picked up by Outlook and Outlook OWA so I assume that it's being changed in AD.

 

[58sniper]

Well, besides my own belief that users should always have the ability to change their passwords, and that no one else should ever have that password unless a business isn't concerned about security.....

How many DCs & GCs? If you run dcdiag from each one, are there any replication issues? If you drop to a CMD prompt from one of these machines, and do a echo %logonserver%, does it list a DC that shows the checkbox checked that they can't change their password?

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.ucblogs.net/blogs/exchange/

 

[gshurman]

2 DCs 1 GC.

No replication errors

dcdiag - all passed

%logonserver% shows just the correct DC name.

 

[Davetoo]

This is indeed strange. Have you checked your GPO's to ensure they're not conflicting? The thing is the AD object would overrule any GPO...but just to be doubly sure.

Are there users that can't change their password?

Create a test user without any GPO's being applied to the OU their in and see if the issue presents itself.

I'm Certifiable, not cert-ified.
It just means my answers are from experience, not a book.

There are no more PDC's! There are DC's with FSMO roles!

 

[gshurman]

Yes, I've checked the GPOs and the first thing I did was to create a test user.I've stumped a few MCSEs who have looked at this. I currently have a call into M$ tech support.

 

[58sniper]

Be sure to post the solution here when they figure it out.

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.ucblogs.net/blogs/exchange/

 

[Davetoo]

Yes, please do that. It makes absolutely no sense why it's happening.

I'm willing to bet though, that it's something quite simple.

I'm Certifiable, not cert-ified.
It just means my answers are from experience, not a book.

There are no more PDC's! There are DC's with FSMO roles!

 

[pagy]

Weird, check the ACL of one of your user objects and look for Deny entries for Change Password on Everyone and SELF.

If the user can change the password then that Deny probably won't be there, hence why they can change the password. Those entries are added when you check 'User cannot change password', so I can't think why it would not have worked in your case. Unless at some point some 'interesting' security changes were made to ACLs in AD????




Paul
MCSE 2003
MCSA 2003
MCITP Enterprise Administrator

If there are no stupid questions, then what kind of questions do stupid people ask? Do they get smart just in time to ask questions?
Scott Adams