5

In our office, we are running some Windows servers running an Active Directory domain . We've got a a number of security policies that we enforce, including a 180 day password expiration policy. Everybody in the company has a laptop that is joined to the domain, a mix of Win7 and Macbook Pro's (Mountain Lion or Lion). Every users domain login is used to log in to their laptops as well as a few corporate resources, including Cisco VPN connection when away from the office.

When the expiration date comes up, it's not a problem for most users. They come in to the office, get the expiration notice, and change their password at login or via the usual change password options for Win7 or OS X.

The problem comes for the handful of office users who are permanently remote. Specifically the Mac users. I've found several ways for users to be notified of an expiring password (scripts+email, adpassmon, etc). The problem is the actual password change. The Windows users can VPN in, hit Ctrl-Alt-Del, change their password and everything is updated and fine. If a Mac VPN's in and tries to change their password, they just get the "password was not changed" message ("your system administrator may not allow you to change your password or there was some other problem with your password...").

Anyone know why, or have a solution for this? I know I could have users VPN in and Remote Desktop to another machine to change their passwords, but this will play havoc with the local machines keychain, as well as sudo privileges, which might just get worse the next time they visit the office.

edit: I should clarify that one of the issues seems to be that even with an active vpn connection, OS X doesn't seem to try and communicate/authenticate against the AD servers (just keeps using cached credentials), even when a password change has been attempted. So even if a password is changed via some external method (OWA, remote desktop, a manual reset by me) the OS X machine will not have the changed password. This will necessitate the user knowing 2 passwords for a length of time, as well as some possible screwy permissions with the keychain and sudo.

Improve this question
2
  • How are you having the Mac users try to change their passwords (e.g. in the Users & Groups preference pane)? Also, when the Macs are connected via VPN are they using the AD controllers as DNS servers or still using external DNS? Finally, does your AD domain end in ".local"?
    – Gordon Davisson
    Jan 17, 2013 at 0:25
  • Password changes via the Users & Groups preferences pane. I need to be able to send out instructions on this so the simpler the better. I've been looking in to DNS being a possible issue (host commands for the AD servers name don't work but a ping using the name does (?)). Tried forcing DNS for the network and VPN connection to be the AD server (in all combinations), but still no luck. Domain name does not end in ".local".
    – user154781
    Jan 17, 2013 at 20:08

2 Answers 2

Reset to default
3

If you have Exchange have you considered implementing the ability to change it via OWA? http://technet.microsoft.com/en-us/library/bb684904%28v=exchg.141%29.aspx

Another alternative is to use ManageEngine's AD self service product: http://www.manageengine.com/products/self-service-password/download.html

One thing "sort of" out of scope of the question is that I always have had great experiences with AdmitMAC: http://www.thursby.com/products/admitmac.html for the Mac's our employees use.

Improve this answer
3
  • We use an outside hosted Exchange service so the OWA option is out. The manageengine looks like an interesting product, but has the same issue as remote desktop solution I mentioned, mainly that the changed password will cause some issues on the local machine. The thursby product looks interesting as a long term solution but will require some vetting and evalutation before we could purchase and roll it out.
    – user154781
    Jan 16, 2013 at 22:39
  • you mention that it works ok when they are in the office vs. VPN, correct? Have you looked into what is preventing the change while VPN'd in? Is it specific to the user or the machine?
    – TheCleaner
    Jan 16, 2013 at 22:45
  • Yes, I've been trying to investigate that, but haven't turned anything up yet. I've only been testing with a single machine with a dummy account. I'm guessing it has something to do with how OS X treats the VPN connection, but can't be sure.
    – user154781
    Jan 16, 2013 at 22:51
2

Just an update, we have the problem solved and it wasn't anything to do with the Mac's specifically. We were having some VPN tunnel issues (some acl mismatch problems were discovered), that was blocking certain groups between sites. Once that problem was taken care of, AD password changes over VPN for the Mac's started working. The VPN that users's log in to is at a different site from the AD servers.

Thanks for your input, everyone.

Improve this answer
2
  • Edit your question, don't post updates as answers.
    – Joel Coel
    Jan 18, 2013 at 21:25
  • Glad you were able to resolve this issue. Please be sure to mark your answer as accepted when you are able.
    – jscott
    Jan 18, 2013 at 21:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.