2012 R2 RD Session Host Domain Users Cannot Change Password

I set up a Windows 2012 R2 Session Host as per
http://support.microsoft.com/kb/2833839 and joined it to the domain. Now, users are unable to change their password. When they log in to the RDSH and "ctrl-del-end", they are given the change password dialog, but they are told that
their password "doesn't meet complexity requirements" even if it does. I suspect the issue is related to the fact that there is no "session collection" per se and that the "connection broker" role is not installed.
Is there any way around this? The end game would be to have them log into this RDSH and be able to change their password to conform with the domain password policy
PaulK

Hi Paulk,
Did you mean that all users cannot change passwords? Based on my experience, this issue was not related ro the RD connection broker role.
Please check the password policy in group policy of the domain to see if any password policy caused this issue:
Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy
For more information, you can refer to the link below:
https://technet.microsoft.com/en-us/library/hh994572(v=ws.10).aspx
Best regards,
Susie
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

Similar Messages

User cannot change password option is automatically getting unchecked while giving domain admin rights

user cannot change password option is automatically getting unchecked while giving domain admin rights

Greetings!
"Domain Admins" falls into the category of protected groups and it is included in ADminSDHolder process. It is normal and was designed in order to prevent the modification to these privileged groups. More information on the link below:
AdminSDHolder, Protected Groups and SDPROP
Regards.
Mahdi Tehrani |
|
www.mahditehrani.ir
Please click on Propose As Answer or to mark this post as
and helpful for other people.
This posting is provided AS-IS with no warranties, and confers no rights.
How to query members of 'Local Administrators' group in all computers?

Migrating from server 2003R2 to 2008R2 User cannot change password box unchecks after being checked.

After Migrating the domain controller from server 2003 R2 to 2008 R2 the check box for users cannot change password wont stay checked. This is happening to ALL users and no they are not a member of any Protected Groups. I have searched for a solution
for months but cant not find.
And now after migrating the exchange 2003 to 2010 I have to keep applying the inherited permissions every hour until a user finally makes an active sync.
Now having more AD issues, cant remove users from Exchange 2010...And again have to go to the DC and applying the inherited permissions, then I can remove the user.
I really need help with this...
John

Hi,
Did you use the migration tools to do the user migration?
Permissions on a user that is migrated from an Active Directory domain are reset to default values during migration.
I think this is by design:
http://technet.microsoft.com/en-us/library/cc974359(v=ws.10).aspx
Regards.
Vivian Wang

How to set "User cannot change password" on W2K accounts.

Hi gurus,
I need to set (from create user form) "User cannot change password" on W2K accounts.
I was expected that some value of userAccountControl attribute on AD could do the job, but I realized that it is not so (look also to http://forum.java.sun.com/thread.jspa?threadID=593193&messageID=3108889).
Thanks for any suggestion.

Yeah thats right, I have implemented the same using nTSecurityDescriptor attribute

Users Cannot Change Passwords on a Server 2012 R2 RDS Farm

Hello I have a Server 2012 R2 RDS Farm consisting of 1 server that has connection broker and gateway configured and 4 RDS Session Hosts. The works great I even have a separate remote app farm to distribute the apps to the servers, my main issue is passwords
and the lack of the EU ability to change these, listed below are my symptoms.
Users password has expired denied logon instantly with no ability to change password.
User tries to change password whilst in 30 day warning period using ctrl alt end the user is advised the password does not meet complexity requirements I have checked this and they do meet them.
Expired passwords can be changed via the RDWeb site however this is not an option for us.
Chris

Hi,
Firstly, based on my knowledge, remote users may have to change their passwords before expired. If not, they have to use OWA or logon on locally to change their passwords.
Regarding the issue, please let us know if the following policies are enabled in your domain.
Enforce password history
Minimum password age
Also, does a local domain user have the same issue?
Thanks.
Jeremy Wu
TechNet Community Support

User cannot change password

Users can log on fine to the 10.4 server (new install) from 9.2 clients with their current passwords, but if they try to change their password they get the following error:
"unknown user, incorrect password or log on is disabled"
BTW, logins are not disabled obviously
ideas? Thanks, Tom

Hi,
just for your information: Re: Change password on the first use - does not work

Lion Server: Users Cannot Change Password

I'm not sure how long this has been the case, as we don't have a ton of users. We recently added a new user, and directed her to our website to change her password (the only service she needs is email), and she gets a window that clearly is not being presented correctly from the server. When you look at the screen, you see that the window title and fields for the user to enter their current name and password list what looks like programming references rather than user-friendly titles.
Even if you enter information and click the button, it gives you the error about the password server not being reached.
Has anyone seen similar issues to this?
Thanks in advance!

isolate it further.
does this occur for this user only? (test other users)
add a new user to see if its related only to newer users
verify your dns, what are the results of the following form terminal: sudo changeip -checkhostname"
Jeff

Exchange 2010 user cannot change password from OWA

My users are not able to change their own email password from owa. But we can change the passwords from ECP or from the server without any issue. What could be the issue ?
Biju Rajan

Check the regional date and time is set for user OWA...Follow the below steps
On the Client Access Server (CAS), click Start > Run and type
regedit.exe and click OK.
Navigate to HKLM\SYSTEM\CurrentControlSet\Services\MSExchange OWA.
Right click the MSExchange OWA key and click New >
DWord (32-bit).
The DWORD value name is ChangeExpiredPasswordEnabled and set the value to
1.
Note: The values accepted are 1 (or any non-zero value) for "Enabled" or 0 or blank / not present for "Disabled"
After you configure this DWORD value, you must reset IIS. The recommended method to reset IIS is to use
IISReset /noforce from a command prompt.
Ref:http://blogs.technet.com/b/exchange/archive/2010/10/06/3411240.aspx
Exchange Queries

Windows 8.1 cannot change password in Windows 2003 domain level domain

On several installations of windows 8.1 enterprise, users cannot change passwords by using <ctrl> + <al> + <del> keys and choosing change password.
The error is: "The security database on the server does not have a computer account for this workstation trust relationship"
Fresh Windows 8.1 enterprise installs with no patches to fully patched windows 8.1 enterprise workstations have the problem. Backed out patches one by one and tested password change without success. Tried various dell laptops, tablets, and workstations
but same issue. Tried VMware guest workstation with windows 8.1 enterprise. The domain functional level is 2003 with a mixture of Windows 2008 R2 DC's and Windows 2003 DC's.
The add/remove from domain did not help. What troubleshooting steps should I take from this point? Is this related to secure channel failures? Note: did not find event log entries for the failures in the DC's nor on the workstation.
Perhaps I did not search for the proper entry on the DC's.

Hi,
Please find below several possible cause of error “The security database on the server does
not have a computer account for this workstation trust relationship”
Secure channel is broken (Can fix by rejoin problematic client to domain)
AD replication issue. The computer account exists on one domain controller but not others.
Duplicated SPN (seems not possible)
So, to narrow down the issue, you need to make sure the AD replication is working fine. Please run command
repadmin /showrepl * on a DC, then post the result here.
After that, please run
set l on a problematic client, then post the result here.
Moreover, please check on system event log and check if there have any related error of the issue.
Thanks.

After joining computer to the windows doamin i cannot change password for Mac for the domain user

After joining computer to the windows doamin i cannot change password for Mac for the domain user

Hi,
Did this problem occures after installed Windows 8.1 Update 1? Here is another thread that had similar problem. Also I don't think this problem relate with Domain. Please refer to the solution of the thread below for reference, If there is any
progress, please let us know.
http://social.technet.microsoft.com/Forums/en-US/08993680-b6f5-4e80-b031-d32fec97d682/not-able-to-right-click-on-tiles-after-81-update?forum=w8itproge
Roger Lu
TechNet Community Support

User cannot change expired password at logon

Hi
I've got 4 Fujitsu laptop with Windows 7 business SP1 x64 (Fujitsu setup). When the domain password expired, users cannot change their password at logon. Also, they can change password in their opened session before it expire (CTRL+ALT+DEL ==>
change password).
The change password at logon windows is buggy : It only display one field to put password in, the confirmation field does not display.
When user valid is change, Windows display error "wrong username or password ". Only way to unlock this situation is to reset user password in ADUC and never let expire.
I seen no sofware or driver wich could interfe.
Domain controler (only one) is Windows server 2012 standard.
Has somebody ever seen this type of problem ?

Hi,
Can you post a screenshot for this situation?
Sometimes, the third party credential provider would lead to some issue like this, I suggest you check the
current credential provider via the following path:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\SessionData\x\LastLoggedOnProvider
You should compare the result with the values in the following path:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\credential providers
If the current value is third party credential provider, try to disable it:
To disable the provider add a REG_DWORD value "Disabled"=1 to that provider’s CLSID subkey.
The provider will be disabled on the next session creation (sessions are created when you log off, switch users, or reboot.
If you have any feedback on our support, please click
here
Alex Zhao
TechNet Community Support

TMG 2010 publishing Exchange 2010 OWA cannot change password if user must change password at first logon is set

Hi,
I have an odd issue whereby if I set "user must change password" on an AD account, the end user cannot logon, they're simply taken back to the OWA login page as if their password is incorrect.
My setup is as follows:
outer TMG -- uses a listener for email.contoso.com and is configured for no authentication.This uses a publishing rule to publish the inner TMG server. This server is not a domain member.
inner TMG - uses a listener for email.contoso.com and is configured for NLTM\kerberos negotiation with forms authentication (Windows Active Directory). This server is a domain member and use a publishing rule to publish the internal CAS. Allow users to change
password is selected in the publishing rules.
Exchange 2010 SP1 - uses integrated windows and basic authentication. Has the appropriate registry key configured to allow users to change their AD password on first logon.
I've registered an snp for "http/email.contoso.com mailserver-dc1", all SSL certificates being used are valid and my configuration used to allow users to login and change their password with "user must change password on first login"
set in AD.
If I launch a web browser on an internal server and point it to email.contoso.com I'm immediately presented with a generic Windows authentication request (similar to what's seen in ADFS) rather than the standard OWA page. No matter what I do, I cannot login
and change my password using the correct URL. However if I point my browser at
http://192.168.4.10/owa I'm prompted to login and I can change my password using the sam credentials.
The only recent changes made are:
- Disabling SSL 3.0 and enabling TLS (http://www.isaserver.org/articles-tutorials/configuration-security/improving-ssl-security-forefront-threat-management-gateway-tmg-2010-published-web-sites.html)
- Replacing the TMG listener certificates so that they now use SHA2 rather than SHA2 (certificates are trusted on each TMG server)
Looking on the outer TMG and the DC logs I can see schannel errors which I believe are related to the problem. TMG monitoring also shows "Failed connection attempt: 1907 The user'spassword must be changed before logging on for the first time"
I've checked that my inner TMG and DC are using the same certificate for server authentication and gone through this guide:
http://blogs.technet.com/b/keithab/archive/2012/02/29/setting-up-and-troubleshooting-ldaps-authentication-in-forefront-tmg-2010.aspx
If I try to use ldp.exe on the inner TMG, I get the error in the pic below
Thanks
IT Support/Everything

Hi,
You could try to analyze the TMG tracing and try the troubleshoot steps in the blog below.
TMG 2010 – FBA, troubleshooting the change password feature
http://blogs.technet.com/b/isablog/archive/2012/05/07/tmg-2010-fba-troubleshooting-the-change-password-feature.aspx
Best Regards,
Joyce

ISE 1.2 Guest portal user cannot change their passwords

I have a WLC 5508(version 7.6) and a server installed the ISE (version 1.2.1.198)，Now we configured the CWA，Use guest portal as an employee and guest login url，We can use the manually create internal user and password successfully logged in, and we set up allow guest users to change password in Multi-Portal, but the user can not change the password in the guest portal ,I suspect the change password option on the Guest Portal actually works? Can anyone tell me how to change their own username password in the guest portal ?

Requiring Guests to Change Password
You can allow or require guest users to change their password after their initial account credentials are created by the sponsor. If guest users change their passwords, sponsors cannot provide guests with their login credentials if they are lost. The sponsor must create a new guest account.
You can either allow guests to change their passwords, or you can require that they do it at expiration and at first login. To require internal users using a guest portal to change their password upon their next login, choose Administration > Identity Management > Identities > Users . Select the specific internal user from the Network Access Users list and enable the change password check box.
Before You Begin
Create a Guest portal or modify the DefaultGuestPortal. This setting is specific to each Guest portal.
Step 1 Choose Administration > Web Portal Management > Settings > Guest > Multi-Portal Configuration.
Step 2 Check the Guest portal to update and click Edit .
Step 3 Click the Operations tab.
Step 4 Check either or both options:
Allow guest users to change password
Require guest users to change password at expiration and first login
Step 5 Click Save .

When using BW Bex query analyzer users cannot change reporting queries ....

Issue: When using BW Bex query analyzer users cannot change reporting queries. Any attempt to change queries results in errors.
Error: BEx Query Designer: Run-time error '-2147221499 (80040005) Fatal Error - Terminating
Impact: Business reporting is currently being negatively impacted because users cannot modify queries, cannot change filters for fiscal period and fiscal year.
OS / MS Office Suite being used: Vista & Office 2007
Backend System: BW 2.0B
Frontend System: Being a large organization, we have a controlled environment wherein all users will have the following applications installed by default:
1. SAP Client Base 7.10
2. SAP BW 3.5 Patch 4
3. SAP BI 7.10 Patch 900
4. SAP GUI 7.10 Patch 12
Does anyone has any idea as to why we are getting this error? Is it a Vista issue? Is it a front-end issue?

Just a thought - did you guys apply any Microsoft security patches before this started happening - we had a similar issue in other SAP application due to MS security update. Raise an OSS with SAP

Invoke-sqlcmd with domain user name and password

I am trying to execute below small SQL script from powershell by passing my domain user name and password..but it is throwing an error login failed for the user.
Howerver I am able to execute the same query by passing normal user 'non domain' and password. The issue is only when i am trying to connect with domain username.
Can you please suggest if there is any way to execute below query with domain user..
Invoke-Sqlcmd
-query "select name from master.sys.databases"
-ServerInstance "CM-NCKM-DBTST04\SQL2012" -username "sos\9venk" -password "xxxx"
Thanks
Venkat
venkat

Hi Venkat,
Agree with Mike, to connect sql via powershell, you can refer to this article about authentications:
Connecting to SQL Server through Powershell
Please try to gather credentials using Get-Credential, and then use New-PSSession -Authentication CredSSP to open the pssession.
A similar discussion about this issue is for your reference:
Invoke-SQLCmd with Different Credential
If there is anything else regarding this issue, please feel free to post back.
Best Regards,
Anna Wang
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

2012 R2 RD Session Host Domain Users Cannot Change Password

Similar Messages

Maybe you are looking for