Some domain users don't have permission to change password??

[gregfranklin]

I have two Windows 2000 Domain Controllers with one group policy for all users. I have a policy which expires user passwords every 90 days with a 5 day grace period. The passwords must meet MS complexity requirements.

The PC environment is a mixed Windows 2000/XP

All users have a local account on each PC with full admin access on the PC.

My issue is that some users either on Windows 2000 or XP can change their password, and some can't. The error is "You do not have permission to change your password".

I don't see anywhere in the group policy where this is enforced. Any help would be much appreciated.

 

[ckugo]

There is a setting in Active Directory under the properties for a specific user on the "Account" tab that specifies whether or not a user can change their password. See if that is your issue.

 

[gregfranklin]

Thanks for the reply, sorry I should have mentioned that I did check the setting under properties that would allow the user to change their password, and all users are allowed....

 

[itsp1965]

Does this happen immediately after you have changed the user's password and they attempt to change it? (ie do you have a policy in place that the user cannot change the new password for a min x days).

 

[Seaspray0]

Check and see if the password for the user is checked for no expiration and uncheck it. If you want to bypass the min password expiration time limit, you can check the account for the user to change password on next logon, which will require the user to change passwords. If the user can change passwords this way, then it is a group policy issue.

Start, Help. You'll be surprised what's there. A+/MCP/MCSE/MCDBA