Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Win2k8R2 server configured as PDC and Terminal Services (yes, i know.). My manager would like users to be able to reset their own passwords by using the Start Menu -> Windows Security -> Change password.

I don't argue with this in principle. He's attempted to change his own password, only to be met with the "Your password is not in keeping with Complexity Rules" message. I've tested from another account the same way, and also cannot change passwords of unprivileged users.

I can change users' passwords by logging on as my account (which is an Administrator, as well as Enterprise and Domain admin), using Active Directory Users and Computers, and then resetting their password.

If they want to reset their password, I'm quite happy for them to come over and do it that way, we're a small team of about 8, it's not a massive task.

However, even if i disable Password Complexity by editing Group Policy, users still can't change their own passwords.

Questions:

  1. What magic setting am I missing to allow them to change their own password?
  2. Is this normal for users to have to visit an Administrator for a password reset? (This is how it worked at a number of other companies i've worked for)
  3. Is there a better way to do this? I don't like having insecure passwords.
share|improve this question
    
To answer your question 2: it entirely depends on your company policy. We have set it up so yes, users can hit the three-key salute and change passwords at will. If in question 3: you mean complexity requirements, that's why they're there, to assist in not having insecure passwords (although users still find a way to make them less secure). The reason I'm putting this in as a comment is because I don't know the answer to question 1:, unless there's something anomalous with that server's local policy that's overriding domain policy. –  Bart Silverstrim Feb 1 '10 at 12:47

1 Answer 1

up vote 1 down vote accepted

I assume the GPO you were changing was the Default Domain GPO; that is the only one that affects domain userid's. GPO's on OU's only affects local accounts on domain-member computers that are in that OU.

Although domains in Win2008 mode can do OU-based policy however I have not researched how nor the details.

share|improve this answer
    
Yep, Default Domain GPO. –  Tom O'Connor Feb 1 '10 at 14:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.