RE: No password expiration message/Can't change password

Hi

1) User Accounts: "Can not Change Passwords" is UN-checked for all users.

2) Default Domain Policy: Local policies-security options: All that shows
(fully expanded) is Network Security
Policy: Network Security: Force logoff when logon hours expire.
Setting: Disabled.

Should there be something else?

I tried to simulate the event by making a dummy user and putting "must
change password at next logon" then accessing the account with Outlook:

At first I get a Must Change Password notice, Click Change Password, get
Change Successful. Close that window and back to logon using new password
gets
"Your logon information was incorrect. Check your uername and domain, then
type your password again. If your account is new or if your administrator
requested a password change you need to Click Change Password then logon with
your new password."

The only log event I see at this time are two Security Audits (see text
below) but nothine in either Appication Log or System:

Event ID: 535
User: NT AUTHORITY/SYSTEM

Logon Failure:
Reason: The specified account's password has expired
User Name: ExchUser
Domain: berlinfinancial
Logon Type: 3
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: BFL-SVR-01
Caller User Name: BFL-SVR-01$
Caller Domain: BERLINFINANCIAL
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 160
Transited Services: -
Source Network Address: -
Source Port: -


For more information, see Help and Support Center at


Event ID: 529
User: NT AUTHORITY/SYSTEM

Logon Failure:
Reason: Unknown user name or bad password
User Name: ExchUser
Domain: berlinfinancial
Logon Type: 3
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: BFL-SVR-01
Caller User Name: BFL-SVR-01$
Caller Domain: BERLINFINANCIAL
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 160
Transited Services: -
Source Network Address: -
Source Port: -


For more information, see Help and Support Center at

I don't see a way to set the password expiration period for an single
account. I would like to be able to test a fix (if there is one) for the
missing password expiration problem.

Jim


""Charles Yang [MSFT]"" wrote:

> Hi,
>
> Thanks for updates.
>
> I suggest you follow my suggestions below:
>
> 1. Right click the user, choose properties.
> 2. In the account tab, please make sure that the "can not change password"
> is not selected for all the users.
>
>
> Check the domain default policy to make sure the prompt user to change
> password is set correctly.
> Domain policy:
>
> Computer Configurations->Windows Settings->security setting->Local
> policies-security options
>
> If possible, please create a new user, does the issue still exist when the
> password expired, you can set the password to expired immediately.
>
> Could you check your event view to see if there are any error messages to
> this issue, paste them to newsgroup?
>
> I appreciate your time in performing the tests, if you have any further
> concerns, please let me know. I will be here waiting for your updates.
>
>
>
> Best regards,
>
> Charles Yang (MSFT)
>
> Microsoft CSS Online Newsgroup Support
>
> Get Secure! - www.microsoft.com/security
>
> ======================================================
> This newsgroup only focuses on SBS technical issues. If you have issues
> regarding other Microsoft products, you'd better post in the corresponding
> newsgroups so that they can be resolved in an efficient and timely manner.
> You can locate the newsgroup here:
> http://www.microsoft.com/communities/newsgroups/en-us/default.aspx
>
> When opening a new thread via the web interface, we recommend you check the
> "Notify me of replies" box to receive e-mail notifications when there are
> any updates in your thread. When responding to posts via your newsreader,
> please "Reply to Group" so that others may learn and benefit from your
> issue.
>
> Microsoft engineers can only focus on one issue per thread. Although we
> provide other information for your reference, we recommend you post
> different incidents in different threads to keep the thread clean. In doing
> so, it will ensure your issues are resolved in a timely manner.
>
> For urgent issues, you may want to contact Microsoft CSS directly. Please
> check http://support.microsoft.com for regional support phone numbers.
>
> Any input or comments in this thread are highly appreciated.
> ======================================================
> This posting is provided "AS IS" with no warranties, and confers no rights.
>
>
> =====================================================
> When responding to posts, please "Reply to Group" via your newsreader so
> that others may learn and benefit from your issue.
> =====================================================
>
> This posting is provided "AS IS" with no warranties, and confers no rights.
>
>
.

Relevant Pages

  • RE: RDP ove HTTPS Passwors for non domain WSs
    ... I found that we can't change password when we use ... Check the checkbox "User must change password at next logon" on the ... Microsoft CSS Online Newsgroup Support ... This newsgroup only focuses on SBS technical issues. ...
    (microsoft.public.windows.server.sbs)
  • Re: Turning on Password Policy
    ... I currently do not have a password expiration set so I will just mark X ... number of accounts each to to change password at next logon. ... >> Is this for LOCAL security policy or default domain policy? ...
    (microsoft.public.windows.server.active_directory)
  • Re: set password expiry to a few weeks.
    ... This is to expire the actual account, not the password, is this right? ... password expire in 2 weeks without changing the Domain policy and ... So once 'change password at next logon' is ...
    (microsoft.public.win2000.general)
  • Re: Force PW change with notice
    ... Domain accounts and a very large number of mobile users. ... > 'Change password at next logon is no good' as it doesn't provide enough ... Hi Navigato, ... cant "logon using dial up networking") when the password expires they cannot ...
    (microsoft.public.security)
  • Re: Set "Password never expires" on users in a specific OU?
    ... You should not assign values directly to the userAccountControl attribute. ... user must change it the next time they logon on. ... ' Check if user must change password at next logon. ... I pieced this together from some other scripts I have.... ...
    (microsoft.public.scripting.vbscript)