Users do not have permission to change password

[DMoll]

Ever since getting SP4 for our Windows 2000 Server all users have been getting "You do not have permission to change your password" messages when trying to change passwords during the expiration period.

We are using Active Directory, all clients are Win 2K/XP Pro and all users have had the problem when trying to change their passwords.

The Everyone group already has the "Change Password" permission set to Allow.

I have seen a couple of previous posts that have mentioned this error but none seem to have any conclusions.

As far as I am aware the only change of any sort on the server has been SP4 update.

 

[NetworkAdmin123]

We're still fighting this probelm as well. We are running Win 2000 Server SP4. We just changed our password policy and had the make everyone change passwords. About 80% of the user could do this fine but the rest kept getting that you don't have permissions crap. We have the everyone group set to allow change password as well. Any suggestions.

 

[patrichek]

Hi,
did you try to make a domain wide group policy to allow users to change passwords?

 

[NetworkAdmin123]

I have a group policy in place. I think I might have found the answer. I noticed all the one that had no problems were xp service pack 2 systems. There is a MS article 328817 that says this should fix this issue and it looks like it does.

Just out of curiousity what would I need to change in the GPO to allow passwords. I have the everyone group set to change passwords.

 

[DMoll]

Found this article and 246261 for Win 2000. Will try it but what is the actual effect on security by changing RestrictAnonymous to 0 or 1?

 

[NetworkAdmin123]

I looked at my Domain Controller and it was already set to 0 so that can't be my issue. Hopefully the rest of the system updated to SP2 today so we'll see if there's been any change.

 

[dholbrook]

Your problem could be that the portion of the registry that users need to access to write the password changes may now be restricted access (as part of the security updates in the service patches), and only administrators may now have access. This in turn gives the "you do not have permission, etc." messgae.

HTH,

David

 

[patrichek]

I have a friend running xp service pack to just installed and he is having a boat load of problems.

 

[patrichek]

i mean service pack 2

 

[NetworkAdmin123]

It was seeming that sp2 fixed the problem.

 

[DMoll]

Had no improvement with SP2 for the XP machines.

But having read MS article 246261 I changed on the server "Additional restrictions for anonymous connections" to "Do not allow enumeration of SAM accounts and shares". All seems to be OK now...