3

I’m looking for an affordable solution to offer a “self-service” password reset portal on the web for my active directory users. (about 150 of them)

Many of them don’t use Windows workstations and therefore can’t reset there own password.

I’ve been Googling, and have found so many options, that I’m not sure how to sort them all out. Has anyone had positive (or negative) experiences with any particular products?

2

5 Answers 5

1

As you said, there are different approaches to change the active directory password. One possibility is to use the password change option in Outlook webaccess. Another option is to use a ldaps-connection and a programming language of your choice (php,perl,python,java) to change the unicodePW-attribute of the users. A PHP library which handles these things for you is for example adldap (http://adldap.sourceforge.net).

1

If you are using Outlook Web Access then I highly recommend this approach, as Dieda suggested. I recently managed a mixed OS environment and was faced with the same problem.

Here is the MS Support doc related to this issue. http://support.microsoft.com/kb/297121 It wasn't as complex as the document seems to make it and worked well for all our users.

1

Yes, there ar a lot of different solutions but it comes down to the level of service you'd like to offer your users. You can indeed use the OWA component for allowing password changes, but, this will not work if the user's password is expired or if the user's account is locked out. It will also not work if you've issued the user a temporary password (must change on next login flag set). Thereis not much in the way of auditing available, or settings to prevent dictionary attacks and potentially allowing a malicious user to lock out your user accounts.

The best solution I've found, and affordable, is Password Reset PRO from . www.sysoptools.com. I looked at a lot of solutions and the good ones (Hitachi-ID and Microsoft ILS) are about $8-$20 per user. The cheapo solutions (there are literally many of these) are NOT secure for external use, will make you install funky databases and/or client software, and are a change control nightmare. They are not designed for external use. The Password Reset PRO product was super easy to install, is extremely secure, and is easy for our users. We found it to be on the same high quality level as Hitachi or Microsoft, but without the high price, and a lot easier to install. It allows users to access / enroll even with a temp password. The enrollment process is like a lot of current banking sites where you choose an image thumb and create an access PIN or security word. Cost was about $3 per user which is excellent for a true enterprise product that is actually secure. Their support is very good and they seem to know a heck of a lot about Active Directory and security. Good luck!

1

There are a several methods but, I would recommend you to use a third party tool such as Lepide Active Directory self service tool as this tool allows all users to change their password on their own. This is a web based tool, enrolling all the users to log in with their user name and password. This also allows the admin to log in to the application and log off to the application. This tool has been tested by me and if you want you can also download its free version, with limitation to number of user at 50.

0

How about a free option?

I haven't been able to dedicate much time to the project recently but I started a free tool years ago that does what you need, and more. Its stable but can be tricky to setup, just like anything AD related.

I was working on a newer MVC version but other projects have tied me up. I'll see if I can get back into the swing of things here shortly.

http://umanage.codeplex.com

Also, we were planning to support ADFS in the next release so your users could have built-in SSO capabilities with other applications.

Not the answer you're looking for? Browse other questions tagged .