Users cannot change passwords 2

[nms42]

Does anyone know why the users on my network get an error when they try to change their password...it says they are denied access to change the password. Yet it tells them that their password has expired and must be changed. Someone else set up this network and I'm not real sure of all the ramifications but it appears to me that the users have the proper rights to change their password. This has been happening more frequently now and I would really like to figure out why and how to stop it. Does it have anything to do with the fact that all of our clients are Windows 98?

 

[MattWray]

Yup,
I can't remember how to do it off the top of my head, I'll dig some more. That is your problem - the 98 machines. Do you have AD running? You can set up new passwords and have them not expire for a temp fix.. Matt Wray
CCNA, MCP
mwray77518@yahoo.com

 

[brontosaurus]

If you're running a W2K domain then you need to install the client extensions (or directory services) for Win98 to gain password change functionality. The extensions will also give your 98 clients the ability to choose a DC for authentication, use NTLMv.2, access DFS shares, and a couple of other AD related tasks that escape me now. MS has a couple of articles on this in TechNet...

 

[Ejaz]

Hi all
I have the same problem, except mine is with 2000 clients! Although it only happens to some of them. Im running AD in mixed mode. Any ideas ? (I use the non-expire fix to get around it temporarily).

 

[gsz11]

I had the same problem. My domain policy had a setting that said Password never expires and user cannot change password. One or the other or a combination of the two, not sure which one it was. Also check to see what the length of the password is. If the min. is set to 30 days and a user tries to change it after 7 days it will not let you.

 

[nms42]

I am running AD on the Win2K server. I have the password policy very light...about the only things I'm enforcing is the password time limit and the number of kept passwords...everything else is loose. I've been changing the passwords on the server to what they want it to be and it's been working. I know I could set them to not expire to get around it but I relly want to try to track down why it's not working. I don't think everyone has this problem. It seems intermitent.

 

[Guest_imported]

Did you try what Bronto suggested the DSCLIENT.EXE? That should fix it.

 

[djameson]

Yes, the DSClient fixed our problems in this area.

It might be worth backing up your secur32.dll file from \windows\system before you run the dsclient.
We had problems running Outlook after running DSClient although copying back the original secur32.dll file afterwards fixed that issue.

 

[Ejaz]

I thought the DSClient only applied to non 2k clients ???

 

[GlenJohnson]

Have you checked also to make sure the users are logging onto the domain and not the local computer, and just using the resources of the domain. I had this problem when I started adding anti-virus software to users. The software automatically selects your users from AD, and installs itself on a pc when a user logs on. Some worked and some didn't. Found out some of the machines were set to log on locally, so they never connected to the domain, and the software didn't run. I changed them to log onto the domain, copied the old profiles over to the new user account, and dis-abled the local account for the user. Now, all authentication can only come from the domain and not a local policy setting. Good luck. Glen A. Johnson
Microsoft Certified Professional

"Things are not always as they seem;
the first appearance deceives many."
Phaedrus (15BC - 50AD) Roman poet, short-story writer

 

[MattWray]

Glen, could you explain briefly how you copied the local profiles to the domain ones.. I have the same prob with users logging on locally, but when I tried to copy to in the user profiles under system properties, I get an explorer.exe error repeatedly. Thanks in advance for any info... Matt Wray
CCNA, MCP
mwray77518@yahoo.com

 

[GlenJohnson]

Right click on my computer, and select properties. The fourth tab over is for user profiles. Select the old profile and say copy to and click on the browse button until you find the new profile. There will also be a button for permitted to use, make sure the new user profile is set there. The explorer.exe error sometimes means virus. Check that. Good luck. Glen A. Johnson
Microsoft Certified Professional

"Things are not always as they seem;
the first appearance deceives many."
Phaedrus (15BC - 50AD) Roman poet, short-story writer

 

[sadamsvalley]

Did anyone fix ejaz's problem? Mine is doing the same w/ XP Pro clients and W2K AD server. User is told password expired but access denied when trying to change it. Doesn't work when logged in and using ctrl-alt-del either. They are logging in to the domain as far as I can tell. It is also not happening to everyone in the directory, only certain computers.