Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it possible for our Windows domain users to reset their own NT password at Windows 7 login screen?

To clarify, we have a corporate network with lots of Windows 7 users. When they forget their passwords, rather than calling IT Support, could they be prompted to answer some security questions, to ultimately reset their own password?

share|improve this question
4  
Tackle the root cause, not just the symptom. Equip your helpdesk with Tasers, and watch how quickly people stop forgetting their passwords. –  HopelessN00b Oct 1 '12 at 15:33
2  
@HopelessN00b Watch how quickly people write their passwords on their monitor, you mean! –  Dan Oct 2 '12 at 12:35
    
@Dan for writing a password on a monitor they get a cattle prod. –  t1nt1n Oct 29 '12 at 16:51
add comment

4 Answers 4

up vote 1 down vote accepted

The answer here, is Yes. And here's how.

  1. I have read, read and then re-read, Dan Griffith's MSDN article on creating Custom Login Experiences.

  2. I then downloaded the Microsoft Credential Providers samples, which are C++ sample projects that demonstrate how to use the Windows log-in Credential Providers for Vista and above.

  3. Modified the sample wrapper application such that I've added a 'Forgot your password' link to the native log on screen.

  4. Made the 'Forgot your password' call off to a C# application that communicates securely with an internal service that communicates with Active Directory to reset the password, following a series of user-specific questions.

Easy. Well, not quite. But straight forward in many ways.

share|improve this answer
add comment

This isn't something built in, but there are third products that can do it using a variety of mechanisms. I've not seen something do it at the logon screen, though, as MS began to lock down the gina quite hard after WinXP.

So, essentially the answer to your question is probably "Yes", but product recommendations are considered off topic on Stack Exchange for a variety of good reasons (http://blog.stackoverflow.com/2010/11/qa-is-hard-lets-go-shopping/).

Also, why do you refer to it as an "NT password"? Do you just mean a general "domain" password, or are you genuinely running an NT domain?

share|improve this answer
    
NT password? Sorry, probably just my age. I meant domain password. –  Brett Rigby Oct 1 '12 at 14:47
    
After reading into all of this, it seems that GINA was replaced due to the architecture of the OS had fundamentally changed from Vista onwards. It seems that the new Credentials Provider mechanism they've implemented is a bit nicer/easier to use but, inherently, has to be written in C++. Eek. –  Brett Rigby Oct 2 '12 at 10:34
add comment

You could try this: http://www.manageengine.com/products/self-service-password/index.html

I haven't used that particular one, but ManageEngine products are usually pretty solid.

share|improve this answer
    
Ha ha, I literally stumbled across their website myself this morning! Thanks though. –  Brett Rigby Oct 2 '12 at 10:32
add comment

You could provide a kiosk station at various locations that allows for functions such as password resets.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.