1

Is it possible for our Windows domain users to reset their own NT password at Windows 7 login screen?

To clarify, we have a corporate network with lots of Windows 7 users. When they forget their passwords, rather than calling IT Support, could they be prompted to answer some security questions, to ultimately reset their own password?

3
  • 4
    Tackle the root cause, not just the symptom. Equip your helpdesk with Tasers, and watch how quickly people stop forgetting their passwords. Oct 1, 2012 at 15:33
  • 2
    @HopelessN00b Watch how quickly people write their passwords on their monitor, you mean!
    – Dan
    Oct 2, 2012 at 12:35
  • @Dan for writing a password on a monitor they get a cattle prod.
    – Zapto
    Oct 29, 2012 at 16:51

4 Answers 4

1

The answer here, is Yes. And here's how.

  1. I have read, read and then re-read, Dan Griffith's MSDN article on creating Custom Login Experiences.

  2. I then downloaded the Microsoft Credential Providers samples, which are C++ sample projects that demonstrate how to use the Windows log-in Credential Providers for Vista and above.

  3. Modified the sample wrapper application such that I've added a 'Forgot your password' link to the native log on screen.

  4. Made the 'Forgot your password' call off to a C# application that communicates securely with an internal service that communicates with Active Directory to reset the password, following a series of user-specific questions.

Easy. Well, not quite. But straight forward in many ways.

1
  • Dan Griffith's MSDN link is not working.
    – CleanBold
    Mar 29, 2017 at 10:49
0

This isn't something built in, but there are third products that can do it using a variety of mechanisms. I've not seen something do it at the logon screen, though, as MS began to lock down the gina quite hard after WinXP.

So, essentially the answer to your question is probably "Yes", but product recommendations are considered off topic on Stack Exchange for a variety of good reasons (http://blog.stackoverflow.com/2010/11/qa-is-hard-lets-go-shopping/).

Also, why do you refer to it as an "NT password"? Do you just mean a general "domain" password, or are you genuinely running an NT domain?

2
  • NT password? Sorry, probably just my age. I meant domain password. Oct 1, 2012 at 14:47
  • After reading into all of this, it seems that GINA was replaced due to the architecture of the OS had fundamentally changed from Vista onwards. It seems that the new Credentials Provider mechanism they've implemented is a bit nicer/easier to use but, inherently, has to be written in C++. Eek. Oct 2, 2012 at 10:34
0

You could try this: http://www.manageengine.com/products/self-service-password/index.html

I haven't used that particular one, but ManageEngine products are usually pretty solid.

1
  • Ha ha, I literally stumbled across their website myself this morning! Thanks though. Oct 2, 2012 at 10:32
0

You could provide a kiosk station at various locations that allows for functions such as password resets.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .