Is it possible for our Windows domain users to reset their own NT password at Windows 7 login screen?

To clarify, we have a corporate network with lots of Windows 7 users. When they forget their passwords, rather than calling IT Support, could they be prompted to answer some security questions, to ultimately reset their own password?

  • 4
    Tackle the root cause, not just the symptom. Equip your helpdesk with Tasers, and watch how quickly people stop forgetting their passwords. – HopelessN00b Oct 1 '12 at 15:33
  • 2
    @HopelessN00b Watch how quickly people write their passwords on their monitor, you mean! – Dan Oct 2 '12 at 12:35
  • @Dan for writing a password on a monitor they get a cattle prod. – Zapto Oct 29 '12 at 16:51

The answer here, is Yes. And here's how.

  1. I have read, read and then re-read, Dan Griffith's MSDN article on creating Custom Login Experiences.

  2. I then downloaded the Microsoft Credential Providers samples, which are C++ sample projects that demonstrate how to use the Windows log-in Credential Providers for Vista and above.

  3. Modified the sample wrapper application such that I've added a 'Forgot your password' link to the native log on screen.

  4. Made the 'Forgot your password' call off to a C# application that communicates securely with an internal service that communicates with Active Directory to reset the password, following a series of user-specific questions.

Easy. Well, not quite. But straight forward in many ways.

  • Dan Griffith's MSDN link is not working. – CleanBold Mar 29 '17 at 10:49

This isn't something built in, but there are third products that can do it using a variety of mechanisms. I've not seen something do it at the logon screen, though, as MS began to lock down the gina quite hard after WinXP.

So, essentially the answer to your question is probably "Yes", but product recommendations are considered off topic on Stack Exchange for a variety of good reasons (http://blog.stackoverflow.com/2010/11/qa-is-hard-lets-go-shopping/).

Also, why do you refer to it as an "NT password"? Do you just mean a general "domain" password, or are you genuinely running an NT domain?

  • NT password? Sorry, probably just my age. I meant domain password. – Brett Rigby Oct 1 '12 at 14:47
  • After reading into all of this, it seems that GINA was replaced due to the architecture of the OS had fundamentally changed from Vista onwards. It seems that the new Credentials Provider mechanism they've implemented is a bit nicer/easier to use but, inherently, has to be written in C++. Eek. – Brett Rigby Oct 2 '12 at 10:34

You could try this: http://www.manageengine.com/products/self-service-password/index.html

I haven't used that particular one, but ManageEngine products are usually pretty solid.

  • Ha ha, I literally stumbled across their website myself this morning! Thanks though. – Brett Rigby Oct 2 '12 at 10:32

You could provide a kiosk station at various locations that allows for functions such as password resets.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.