Re: Force password change permission

Tech-Archive recommends: Fix windows errors by optimizing your registry

That would have to be a bug in the GUI then. You only need WP to pwdLastSet to force an account to have to change its password (make it expired).

Write Account Restrictions gives far more rights than that, last I looked it gave you all of these

accountExpires
msDS-User-Account-Control-Computed
pwdLastSet
userAccountControl
userParameters


which is far more rights than reset password and force to change on next logon.

   joe

--
Joe Richards Microsoft MVP Windows Server Directory Services
www.joeware.net


Todd J Heron wrote: 
Nick wrote:

Hi there,

I'm having trouble delegating control of an OU to a user. I want this user
to be able to reset passwords and force the user to change their password
upon their next login. I've used the delegation control wizard to give the
user these permissions, and the permissions appear correct in the ACL (has
permission to reset password and to write pwdlastset) - the result is that
although they can reset the password successfully, the 'user must change
password upon next logon' checkbox is greyed out.

Any help is much appreciated!

Cheers,
Nick



The user needs "Write Account Restrictions" to be able to make this happen.
http://support.microsoft.com/default.aspx?scid=KB;en-us;296999

.

Relevant Pages

  • Re: Force password change permission
    ... You only need WP to pwdLastSet to ... > force an account to have to change its password. ... > which is far more rights than reset password and force to change on next logon. ... >>>user these permissions, and the permissions appear correct in the ACL (has ...
    (microsoft.public.windows.server.active_directory)
  • RE: Unlock acct permissions
    ... How to delegate the unlock right. ... I have an MMC created for user to reset passwords (will ... > this fix an account lockout?) ... What permissions are necessary and where to access them as ...
    (microsoft.public.win2000.active_directory)
  • Re: Unlock acct permissions
    ... How to grant help desk personnel the specific right to unlock user accounts: ... > What permissions are necessary for a user to be able to unlock an account ... I have an MMC created for user to reset passwords (will ... What permissions are necessary and where to access them ...
    (microsoft.public.win2000.active_directory)
  • Re: User must change password at next logon for local account
    ... pwdLastSet is not exposed by the WinNT provider. ... local account, and the local SAM account database is not LDAP compliant, you ... Microsoft MVP Scripting and ADSI ...
    (microsoft.public.scripting.vbscript)
  • Active Directory LDAP PwdLastSet attribute
    ... Basically when the user logs into the app. ... user's AD account password has expired. ... which is suppose to set the account never to expire. ... I have seen plenty of code to set the PwdLastSet to zero to force the ...
    (microsoft.public.dotnet.languages.vb)