1

When I reset user passwords in Active Directory on Windows Server 2008 or Windows Server 2012 and check the option User must change password at next logon it prevents users from being able to login.

However when I do not check this option and reset their password and unlock their account the users can login successfully. This obviously present a bit of a security issue.

I'm not versed enough in AD to know why this is occurring, has anyone seen this before?

Improve this question
8
  • 1
    Please define "prevents users from being able to login": what error, what does or does not happen? Is password complexity enabled?
    – Ed Fries
    Jul 23, 2013 at 4:55
  • @EdFries - If a user locks their account, they'll call IT for us to unlock them, reset their password, etc... But when I do this and check the option to force them to change it, they are still essentially locked out and cannot login. Same occurs for new users. Ill see if I can get a screenshot when Im back in the office.
    – ProfessionalAmateur
    Jul 23, 2013 at 5:21
  • We would at least need the error message it gives out to be of any help. It sounds like you might have a credential provider installed too; is this the case?
    – Falcon Momot
    Jul 23, 2013 at 5:27
  • @FalconMomot - Im not sure what a credential provider is? Im a programmer that helps out the helpdesk people if passwords need to be reset and no one is here, so Im missing a lot of basic AD knowledge. I just know that this feature being broken doesn't make any sense and it can't be a bug in AD.
    – ProfessionalAmateur
    Jul 23, 2013 at 14:34
  • That is exactly why I asked. Credential providers are the successor to GINA plugins; they modify the login screen in some way. I also wonder what else is in your environment - is something that authenticates against AD repeatedly trying an expired password instead of asking the users to change it?
    – Falcon Momot
    Jul 23, 2013 at 19:02

3 Answers 3

Reset to default
1

The only time I've seen something like this was when we deployed a NAC agent that only allowed certain ports unless the user had logged in. Basically, network services had allowed the ports to log in but were blocking the ports needed to change passwords.

If you're using some kind of similar product, or are otherwise in a similar situation, you'll need to make sure that port 464 is open in addition to the LDAP ports (389 and 636). There's a full list of AD ports here: http://technet.microsoft.com/en-us/library/dd772723%28v=ws.10%29.aspx

Improve this answer
0

Is your domain functional level 2012? Sounds like your password policy has entries defined for password age. (I think 2012 dictates that users must wait 1 day to change their password by default.) You should take a look at your Group Policy password settings.

http://technet.microsoft.com/en-us/library/hh994572(v=ws.10).aspx

Improve this answer
1
  • Forced password changes override this policy. If I recall, the implementation sets passwordLastChanged to -1 to force the change.
    – Falcon Momot
    Sep 19, 2013 at 17:51
0
  1. Run tsconfig.msc
  2. Right click on the RDP Connection "RDP-Tcp" and click "properties
  3. Under the General tab, change the Security Layer to "RDP Security Layer"
Improve this answer
3
  • Jacob - This setting will only affect RDP though correct? What about users who are trying to VPN in or simply login to their desktop?
    – ProfessionalAmateur
    Sep 19, 2013 at 19:11
  • Correct, this would only be for users using remote desktop to the server (sorry).
    – Jacob
    Sep 19, 2013 at 20:41
  • Thanks, I just wanted to make sure I understood the answer provided, I do not know enough about AD so it might have been part of the problem we have.
    – ProfessionalAmateur
    Sep 19, 2013 at 22:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .