Account Operators couldn't reset their own passwords

We have new admin accounts created for the L1 admins and they're supposed to have the ability to unlock accounts, reset user passwords, create, delete and modify groups and membership, manage print servers and add/remove computers to domain.
These admin accounts are part of Account Operators, Print Operators and another security group (delegated in OU level for managing the workstations in the domain like adding/removing).
We're using Windows 2012 R2 Standard.
The issue is the new admin accounts have the ability to perform all their tasks other than resetting their own passwords. Appreciate your response on this as this is creepy and lingering for a week and still couldn't figure out the cause.

They can change their own passwords, but they can't reset them. It's a limitation of the group.
By default, that ability to reset (not change) a password, is reserved for the administrators group or a group delegated with the ability.
Securing Active Directory Administrative Groups and Accounts
http://technet.microsoft.com/en-us/library/cc700835.aspx
Issues with members of account operators group in Active Directory inability to reset their own passwordhttps://social.technet.microsoft.com/Forums/en-US/4d3ff82c-38de-4f0f-b516-d32bfb9aa050/issues-with-members-of-account-operators-group-in-active-directory-inability-to-reset-their-own?forum=winserverDS
Account Operators cannot change their Own passwords
http://www.winvistatips.com/threads/account-operators-cannot-change-their-own-passwords.552783/
Ace Fekay
MVP, MCT, MCSE 2012, MCITP EA & MCTS Windows 2008/R2, Exchange 2013, 2010 EA & 2007, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
Complete List of Technical Blogs: http://www.delawarecountycomputerconsulting.com/technicalblogs.php
This posting is provided AS-IS with no warranties or guarantees and confers no rights.

Similar Messages

OD users resetting their own passwords

Looking for a mechanism whereby OD users can reset their own passwords--specifically users without workstation access.
I am deploying a lot of blog/wiki services to clients. Am finding that I have to generate random passwords for them--would rather push them a temp pw & let them reset on first wiki login, as I can with workstation users.
Any help appreciated.

And you can set the password lifetime and reset and character-content policies in Server Admin > Open Directory > Policies > Passwords, if you've not already found that set of knobs.
I'd also suggest looking to two-factor or certificate-based approaches, if you're having requirements around password resets.

Enable portal users to reset their own password

Dear Forum,
I want our users to be able to reset their own password in our portal solution (NW7.01). I tried to add "pcd:portal_content/com.sap.pct/every_user/general/com.sap.portal.eu_role" but it gives too many options, users should not be able to change their name only password. I thought about changing UME parameters "UME Manage_My_Password
UME Manage_My_Profile" But I am in doubt where to change this in VA. I guess some security settings also apply (lenght, digits, capital letters etc) which should be in the security tab?
I hope someone can elaborate.
Thanks in advance,
Kind Regards,
Soren

Hi Manoj,
UME parameters are in visual admin of the java stack - not sure if this was what you were asking. i was hoping that there was a parameter I could set which would apply a additional button on login screen where you could reset your password, or maybe do it from the portal / personal settings yourself.
I am not much into programming web dynpro tools, so I think ill try to see if I could find a way to enable "forgot your password?" on the login page where you can mail a new password for yourself.
Thanks tho for the link, its much appreciated!
Kind Regards,
Soren

Allowing user to reset their own password in BOXI3 SP3

Is there (a new) possibility to have users reset theri own password in BOXI3.1 SP3
Thansk for any help

I have to refrase my question, I am looking for the possibility to let the USER ask for a new password in case of "password forgotten" (The user is NOT logged on yet)
He/she should then ask via a link for an new password without bothering the BO-user-administration.
This functionality is found on many websites, so I thought : there should be a possibility WITHIN SAB/BO
On BOB I found a document named "Self-Serve Documentation.doc";, may be ther is a easier way ??

Users changing their own passwords

we have set up an Open Directory and are going through the steps to deploy. One issue we have yet to find an elegant solution to is user's passwords and changing them on a regular basis. Many of the contracts we deal with stipulate user passwords are to be changed every 45 days.
Now - there is no way we want our users monkeying around in Workgroup Manger changing their own passwords - and the last thing we on the IT team want to do is perform data entry tasks every couple of months to change everyone's password. Plus - for security reasons - this is a terrible idea.
so - is there an easy way to have a user update their password without going through Workgroup Manager?
thanks

And you can set the password lifetime and reset and character-content policies in Server Admin > Open Directory > Policies > Passwords, if you've not already found that set of knobs.
I'd also suggest looking to two-factor or certificate-based approaches, if you're having requirements around password resets.

Can I set my kids up under my apple ID but with separate accounts so they all have their own cloud memory?

can I set my kids up under my apple ID but with separate accounts so they all have their own cloud memory?

YYes. https://www.apple.com/support/icloud/family-sharing/
BUt separate I'd for imessage, icloud and FaceTime.

Is there a way to prevent an end-user from changing their own password?

All you guru's out there, I need your help. Is there a way to prevent an end-user from changing their own password? Is there a function or procedure I can create or what?

In this case, you do not want someone (whoever they are DBA etc) to connect as that
particuler user to change the password.Yes, but I wouldn't expect the users to[i] know that password. The connnect would be handled automatically, behind the scenes.
The clear implication of the OP's question and response was that users would not be allowed to change their own passwords. I'm guessing this is in response to a policy that says users mustn't have simple passwords like 123abc or mom. In such a scenario a better approach would be to apply regexp to a user's password to ensure it contains a mix of letters, numbers, punctuation, etc to achieve the desired level of complexity.
So questions, should not be regarded as daft Agreed, but the same is unfortunately not always true of business decisions. As the OP has told us not to ask we cannot know why they want to do this. Personally, I think a user's individual password should always be their responsibility; anything else strikes me as insecure. YMMV.
Cheers, APC

User's changing their own password

Is it possible to allow user to change their own password when logged onto a portal applicastion I have written ?

Presumably, the application you say you have written, is a Login Server partner application. So changing the user's password means changing it on the login server.
The URL that you need to go to, to do this, is something like: http://server.domain.com/pls/portal30_sso/portal30_sso.wwsso_app_user_mgr.change_password?p_done_url=xxxxx
Where xxxxx is the URL where you want control to go after the user submits their new password.
null

One iTunes account for family or each their own?

My 16 year old daughter has an iPhone 4; I just got a 5. I have an iTunes account and have enabled home sharing. Should she have her own account or is one sufficient for us both? Recommendations, Please and thanks!

Good question.
I like the idea of each person staying out of the other's way, so generally my opinion would be each should have their own account.
However, I don't think a 16 year old is allowed to have their own Apple ID. I believe the minimum age is 18.
So maybe Apple has a way around that (like have a parent in custody of a child's account). I'm not smart enough to know.
The advantage of individual accounts is you won't get each other's mail, texts, etc.

Skipped. You can't reset your own password

Hi i am using Sharepoint 2013 office 365. (Admin)I could not change my password as shown below. But other users can change their password. How to change it? Thanks in advance.

Hi Thiru,
Please follow the below mentioned links:
http://community.office365.com/en-us/w/manage/changing-and-resetting-passwords-for-office-365.aspx
http://community.office365.com/en-us/b/office_365_community_blog/archive/2012/11/27/reset-your-administrator-password-for-office-365.aspx
Hope it will solve your problem.
Best Regards,
Brij K

How to enable ebs users to change their own passwords.

Hi,
Is there any profile option which will enable the users to change their passwords on their own from EBS front-end applications...?

Hi,
Is there any profile option which will enable the users to change their passwords on their own from EBS front-end applications...?Users can change their password from the application itself (Edit > Preferences > Change Password).
If you want to force all users to change their password, see (How To Force All Applications Users To Change Their Password? [ID 414976.1]).
Also, see old threads for similar discussion -- http://forums.oracle.com/forums/search.jspa?threadID=&q=414976.1&objID=c3&dateRange=all&userID=&numResults=15&rankBy=10001
Thanks,
Hussein

Hello, is it possible to have a password preventing from opening thunderbird and not a password to save accounts and their own passwords, thank younot cdhow

fot thunderbird portable and thunderbird installed
thank you

The suggestion below is largely a cosmetic and superficial protection.
This add-on:
https://addons.mozilla.org/en-US/thunderbird/addon/startupmaster/
…provides a single log-in window, asking for your Master Password, which must be entered before Thunderbird displays.
However, it is offered via an add-on, so can be overcome by anyone who knows how to start Thunderbird in Safe Mode.
More importantly, you ought to be aware that your mail store saves the bulk of your messages in plain text, and can be read easily by anyone who knows how to use the file manager and a text editor. So if you lose your USB memory stick, your email is pretty much guaranteed to become public property.
Rather than seeking a password to open Thunderbird, you perhaps need to look at securing the contents of your memory stick.
For installed Thunderbird, the User Account password offered by the operating system, backed up by encryption of your personal data is the surest way to protect your stored mail.

Using one azure table storage account for many customers with their own data

I'm developing app that will allow the customers to store their data in azure. However, currently I have no idea how to split accounts of the customers in azure. Yes, I'm just started to read the documentation, but maybe someone can point me to the
right topic?

It seems like it might be worth starting from the general guidance to developing multitenant cloud applications - this resource might help: http://msdn.microsoft.com/en-us/library/ff966499.aspx
The patterns covered in this guidance might apply to data storage mechanism chosen for the application - whether it's Azure Storage , Azure SQL DB or else.

HT204266 I would like my kids to have separate itunes accounts under my umbrella itunes account so they can separate their own gift cards. Is there a way to do this?

I would like my kids to have separate accounts within my iTunes umbrella acct to manage their gift cards and purchases. Is there a way to do this?

You can set up accounts for them, but they will be completely separate. There is no "umbrella" account or global management where you can view and control multiple accounts. You'll have to log into each iTunes Store account separately to redeem gift cards, view purchases, etc. To set up a new iTunes Store account for each child, each will need a separate email address.
Regards.

I want to turn off the administrator password which is required when my kids sign onto the internet. They have their own passwords and pages.

I cannot figure out where the administrator password is so I can disable it. I do have parental controls on.

Hey Csound1,
Looks like we found a solution, it's Mickey Mouse but it works. After talking to two Apple Senior Advisors, this is the fix they came up with:
The first advisor after exploring it for awhile, came to the conclusion the way to get my calendars back local On my Mac with the alerts as I had then was to import the saved .ics files with my my 'dangerous email alerts' being removed then me manually re-adding them. I said that was a no go.
The second advisor, after speaking with me for awhile and trying a few things that we'd tried before said he'd do some work on his end and call me back. A couple of hours later he phoned back with a fix that I guess will have to do, his solution:
I had to go into Calendar-preferencs-accounts and create a Gmail calendar, quit and restart Calendar, I created a calendar in the gMail account. Then I was given the option in Calendar under File-New Calendar to create On my Mac local calendars. Next was to create local calendars with the same names as my iCloud calendars. Now I had to un-check all calendars but one, put Calendar in month view, command-click all the events for the given calendar and drag them to the new local calendar of the same name. I then had to repeat this for each of the calendars and for all 12 months of the year.
I'm not done yet but it seems to be working. As I said Mickey Mouse but doing the job. It seems creating another online calendar account was the only way to get the local On my Mac option, active again. What a pain in the a** this has been, I will repeat it again
iCloud is EVIL.

Account Operators couldn't reset their own passwords

Similar Messages

Maybe you are looking for