Look into the IISADMPWD virtual website solution. We've implemented this to allow users who are connecting via VPN to change their passwords. We also use it in an office with a non-domain environment to allow users to personalize their passwords after being assigned the default when they start. the site also allows users to change passwords for their accounts even after they expire.
We've found it to be very useful. I think it would address you issue.
Check out
But know that when I implemented using the same document I found that you need tofollow the steps below:
Enable your server to allow ASP scripting - which is disabled by default on
W2K3 servers.
In the article when configuring the IIS metabase it specifies to use the
command:
"adsutil.vbs set w3svc/1/PasswordChangeFlags [value].w3svc/1" -- note the
period
when actually configuring the metabase and issuing this command you will
need to use the proper form:
"adsutil.vbs set w3svc/1/PasswordChangeFlags [value] w3svc/1" -- note the
space instead of the period.
Also the path it gives to the site for non-domain accounts is:
" http
://[server address]/iisadmpwd/aexp2.asp " -- note the s for SSL is
optional based on your server's configuration. If you are NOT using SSL
(which I do not suggest) the proper URL becomes...
" http://[server address]/iisadmpwd/aexp4.asp " (adding b to the filename
eg: aexp#b.asp changes the password support from local security to domain
security).
Hope this helps,
Ben