Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a few web applications that use Active Directory to authenticate. What I would like to be able to do is provide a simple web page that would allow users to update their AD password.

This wasn't a problem when the majority of the users had windows machines that connected to this AD server (and could ctrl-alt-del to change the password), but we are moving away from that and the AD server is mostly for web apps.

Is there a simple solution for this, or am I looking at the big LDAP managers?

share|improve this question

7 Answers 7

up vote 7 down vote accepted

If you need an option beyond Outlook Web Access it's still very easy using something like:

Set objUser = GetObject("LDAP://cn=myerken,ou=management,dc=fabrikam,dc=com")
objUser.ChangePassword "i5A2sj*!", "jl3R86df"

from the Users bit of the Script Repository at http://www.microsoft.com/technet/scriptcenter/scripts/ad/users/default.mspx?mfr=true

It would be trivial to embed this in an ASP script. I'd force the use of SSL though :-)

JR

share|improve this answer

One more ready-made product that supports Active Directory web interface: http://www.adaxes.com. Password update is one of many self-service tasks that can be implemented by the software. All you need to do is to delegate the necessary permissions via admin console and users would do their job using web browser. Thank you.

share|improve this answer

I actually found a solution to this that is nearly exactly what I wanted. IIS comes with this functionality out of the box, it was just hidden.

I used this article to get started.

Basic steps:

A. The version of Internet Information Services (IIS) 6.0 that ships with Windows 2003 includes some Web-administration tools that are disabled by default. To enable the tools, perform the following steps:

  • Run Internet Information Server (IIS) Management.
  • Under the default website choose New->virtual Directory to start the wizard
  • Name the site IISADMPWD
  • The publish folder value is enter C:\windows\system32\inetsrv\iisadmpwd
  • For permissions make sure Read and Run scripts are checked

Then the page should be accessible at http://localhost/iisadmpwd/aexp2b.asp

If you get a 404 on the actual file you may have to enable the server to run asp pages.

share|improve this answer
1  
This looks like a very useful feature, unfortunately it is no longer available with Windows 2008/IIS 7 - which is what I run. It looks like you can copy the old IISADMPWD from an IIS 6 install if you have it: blogs.msdn.com/b/asiatech/archive/2009/03/17/… , unfortunately I don't have an old IIS 6 lying about so I'll keep looking :-( –  Guss Jul 10 '11 at 8:24

If you have Sharepoint deployed, there are also a bevy of WebParts designed to let you modify Active Directory content. Lots of it is fancy paid software, but not everything:

http://www.codeplex.com/adselfservice

share|improve this answer

You can do this, and its quite simple to write something if you have a bit of programming experience, if not there are a number of ready made products out there to do it:

share|improve this answer
    
I've installed ManageEngine's ADSelfService, and it works fine. It also has tons of other features, most of which I haven't yet played with, such as sending notification emails when passwords are about to expire. –  Guss Jul 10 '11 at 10:16

If you're running Exchange, look at this KB article: Implementing the Change Password feature with Outlook Web Access

share|improve this answer

The beyond-simple answer - if you have Exchange and OWA - is to just have them change their password within OWA.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.