Exchange 2010 users cant change password in OWA when Cas server is Exchange 2013 cu3

Running Exchange 2010 and 2013 in mixed mode. users who is still on Exchange 2010 cant change password in OWA. It worked when it was clean Exchange 2010 installation. Password change is working for users migrated to 2013
LS

Hi
Please follow the below blog which will help you in solving this issue
http://technet.microsoft.com/en-us/library/bb684904.aspx
Note: Be careful while modifying the registry settings.
Please mark as helpful if you find my contribution useful or as an answer if it does answer your question.That will encourage me - and others - to take time out to help you.
Regards,
Sathish

Similar Messages

Exchange 2010 user cannot change password from OWA

My users are not able to change their own email password from owa. But we can change the passwords from ECP or from the server without any issue. What could be the issue ?
Biju Rajan

Check the regional date and time is set for user OWA...Follow the below steps
On the Client Access Server (CAS), click Start > Run and type
regedit.exe and click OK.
Navigate to HKLM\SYSTEM\CurrentControlSet\Services\MSExchange OWA.
Right click the MSExchange OWA key and click New >
DWord (32-bit).
The DWORD value name is ChangeExpiredPasswordEnabled and set the value to
1.
Note: The values accepted are 1 (or any non-zero value) for "Enabled" or 0 or blank / not present for "Disabled"
After you configure this DWORD value, you must reset IIS. The recommended method to reset IIS is to use
IISReset /noforce from a command prompt.
Ref:http://blogs.technet.com/b/exchange/archive/2010/10/06/3411240.aspx
Exchange Queries

Outlook 2013/ Exchange 2010 User Mailbox reached Limit and OWA is not reachable

Hello Folks,I have a strange Outlook/ Exchange problem with one of our Users, interestingly it’s the Boss of our company….The Background:- We have 2 Domains @company-1 or @company-2- We have 1 Exchange 2010 Server Version 14.03.0224.002- Till March of this year our Emails where hosted externally, we used to download the Emails every 2 minutes from POP3 Mailboxes into Exchange- We have 18 Users- So every User had a User account on our Exchange and a Mailbox externally- Now we host our Emails our self via MX and DNS Records(mail.company.cc)- The User kept their Exchange accounts, OWA is now working too So far all works well on my little Server farm.The Catch:Usually our users have only one Email address either @company-1 or @company-2 Except our Boss and one other User, they have an Email address in both Domains They have addresses one...
This topic first appeared in the Spiceworks Community

Hi,
I suggest to repair .ost file to check this issue by the following steps:
Exit Outlook.
In Control Panel, click or double-click Mail.
In the Mail Setup dialog box, click E-mail Accounts.
Click the Data Files tab, select the Exchange account, and then click
Open File Location. A file explorer window opens to the location of the data file for the Exchange account. The
Account Settings and Mail Setup dialog boxes will remain open, behind the file explorer window.
Close the Account Settings and the Mail Setup dialog boxes, then return to the file explorer window.
Important: be sure to close these two dialog boxes before you delete the file. If they aren't closed, Windows may display an error message about a conflict.
In the file explorer window, right-click the Exchange data file and then click
Delete. The next time you start Outlook, a new .ost file is created for the account.
Best Regards.
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]
Lynn-Li
TechNet Community Support

TMG 2010 publishing Exchange 2010 OWA cannot change password if user must change password at first logon is set

Hi,
I have an odd issue whereby if I set "user must change password" on an AD account, the end user cannot logon, they're simply taken back to the OWA login page as if their password is incorrect.
My setup is as follows:
outer TMG -- uses a listener for email.contoso.com and is configured for no authentication.This uses a publishing rule to publish the inner TMG server. This server is not a domain member.
inner TMG - uses a listener for email.contoso.com and is configured for NLTM\kerberos negotiation with forms authentication (Windows Active Directory). This server is a domain member and use a publishing rule to publish the internal CAS. Allow users to change
password is selected in the publishing rules.
Exchange 2010 SP1 - uses integrated windows and basic authentication. Has the appropriate registry key configured to allow users to change their AD password on first logon.
I've registered an snp for "http/email.contoso.com mailserver-dc1", all SSL certificates being used are valid and my configuration used to allow users to login and change their password with "user must change password on first login"
set in AD.
If I launch a web browser on an internal server and point it to email.contoso.com I'm immediately presented with a generic Windows authentication request (similar to what's seen in ADFS) rather than the standard OWA page. No matter what I do, I cannot login
and change my password using the correct URL. However if I point my browser at
http://192.168.4.10/owa I'm prompted to login and I can change my password using the sam credentials.
The only recent changes made are:
- Disabling SSL 3.0 and enabling TLS (http://www.isaserver.org/articles-tutorials/configuration-security/improving-ssl-security-forefront-threat-management-gateway-tmg-2010-published-web-sites.html)
- Replacing the TMG listener certificates so that they now use SHA2 rather than SHA2 (certificates are trusted on each TMG server)
Looking on the outer TMG and the DC logs I can see schannel errors which I believe are related to the problem. TMG monitoring also shows "Failed connection attempt: 1907 The user'spassword must be changed before logging on for the first time"
I've checked that my inner TMG and DC are using the same certificate for server authentication and gone through this guide:
http://blogs.technet.com/b/keithab/archive/2012/02/29/setting-up-and-troubleshooting-ldaps-authentication-in-forefront-tmg-2010.aspx
If I try to use ldp.exe on the inner TMG, I get the error in the pic below
Thanks
IT Support/Everything

Hi,
You could try to analyze the TMG tracing and try the troubleshoot steps in the blog below.
TMG 2010 – FBA, troubleshooting the change password feature
http://blogs.technet.com/b/isablog/archive/2012/05/07/tmg-2010-fba-troubleshooting-the-change-password-feature.aspx
Best Regards,
Joyce

Exchange 2013 OWA user must change password at next logon not working

Hi,
I have installed Exchange 2013 on Windows 2012 Server. I create users in ECP and select "user must change password at next logon" option. When newly created user logs in, the OWA page doesn't prompt for password change and just throws error "The
user name or password you entered isn't correct. Try entering it again"
I have enabled Change Password feature in CAS server, but still not working.
Any answers, suggestions would be great help
Regards
Sunil

Hi Sunil,
Have you tried as Martina said and does it work?
If not, please try to set the Minimum Password Age to 1 according to link below. I found some threads which are similar to yours and were solved by this way in Exchange 2013 environment.
http://support.microsoft.com/kb/827614
And for further troubleshooting, please create a new user with "user must change password at next logon" option checked and see if he can log on domain-joined PC.
In addition, please check the event log to see if there is any related error message.
Regards,
Rebecca

Exchange OWA does not load OWA for Exchange 2010 users

I have recently installed Exchange 2013 SP1 CU4 in my existing Exchange 2010 SP3 environment but when I use Exchange 2013 OWA to login Exchange 2010 users (it should automatically take the user to Exchange 2010 OWA) but I get this error message "Forbidden
403- Access is denied". However exchange 2010 users can login to their /ecp directory from exchange 2013. Exchange 2010 users can use OWA using their exchange2010/owa URL without any problems. We do not have any http or https redirection enabled
on any of the server. Also I have tried to uncheck the "Required SSL" settings for default web site on both Exchange servers but error is still same. Any help will be highly appreciated.

Hi,
According to your description, your Exchange 2013 cannot proxy OWA request to Exchange 2010 server, but ECP　request　can work properly.
In this case, Ｉ'd like to confirm OWA and ECP settings on Exchange 2013 and 2010 servers before going further:
Get-OWAvituraldirectory |fl identify,*url,*authentication
Get-ECPvituraldirectory |fl identify,*url,*authentication
Thanks,
Angela Shi
TechNet Community Support

Migrating from server 2003R2 to 2008R2 User cannot change password box unchecks after being checked.

After Migrating the domain controller from server 2003 R2 to 2008 R2 the check box for users cannot change password wont stay checked. This is happening to ALL users and no they are not a member of any Protected Groups. I have searched for a solution
for months but cant not find.
And now after migrating the exchange 2003 to 2010 I have to keep applying the inherited permissions every hour until a user finally makes an active sync.
Now having more AD issues, cant remove users from Exchange 2010...And again have to go to the DC and applying the inherited permissions, then I can remove the user.
I really need help with this...
John

Hi,
Did you use the migration tools to do the user migration?
Permissions on a user that is migrated from an Active Directory domain are reset to default values during migration.
I think this is by design:
http://technet.microsoft.com/en-us/library/cc974359(v=ws.10).aspx
Regards.
Vivian Wang

User cannot change password option is automatically getting unchecked while giving domain admin rights

user cannot change password option is automatically getting unchecked while giving domain admin rights

Greetings!
"Domain Admins" falls into the category of protected groups and it is included in ADminSDHolder process. It is normal and was designed in order to prevent the modification to these privileged groups. More information on the link below:
AdminSDHolder, Protected Groups and SDPROP
Regards.
Mahdi Tehrani |
|
www.mahditehrani.ir
Please click on Propose As Answer or to mark this post as
and helpful for other people.
This posting is provided AS-IS with no warranties, and confers no rights.
How to query members of 'Local Administrators' group in all computers?

How to Restrict users to change password

Hi All,
I would like to restrict user to change password only defined number of times in a day, Is it possible to do it through group policies.
Please note i am already aware of "Minimum Password age" feature, however i do not want to use it as the minimum value that i can set here is 1 day. I would like to restrict users based on password reset threshold e.g. User can reset his password
in a day only twice or thrice.
Thanx & Regards,
Wasim Parkar

If you want to limit the user to have his/her password changed for a specific number of time every day, I have to say
NO thats not possible. PSO's as other mentioned,can be used to have different password policies. Maybe you can set the msDS-MinimumPasswordAge
to 00:04:00:00 which is equal to 4 hours. It means every 4 hours a user will be able to change his/her password. So in each day a user can change the password 6 times, since a day is 24 hours.
Do not forget a day start from 00:00 AM up to 11:59 PM. So in a 9 to 5 job, a user may change the password 2-3 times.
Hope it helps.
Mahdi Tehrani Loves Powershell
Please kindly click on Propose As Answer or to mark this post as
and helpfull to other poeple.

Create a user through the API and "Prompt user to change password after next login".

Using the Adobe Connect Interface, I can create a user and check the checkbox to "Prompt user to change password after next login".
Can I achieve the same result using the API? The principal-update action doesn't offer such an option and, as far as I can tell, there isn't another action to do so either.
Thank you.

You can achieve it as part of your application functionality, but not as a configuration option on WLS.

How to set "User cannot change password" on W2K accounts.

Hi gurus,
I need to set (from create user form) "User cannot change password" on W2K accounts.
I was expected that some value of userAccountControl attribute on AD could do the job, but I realized that it is not so (look also to http://forum.java.sun.com/thread.jspa?threadID=593193&messageID=3108889).
Thanks for any suggestion.

Yeah thats right, I have implemented the same using nTSecurityDescriptor attribute

Exchange 2003 users are unable to send attachments larger then 8 MB to Exchange 2010 users on the same LAN

I am migrating from Exchange 2003 to Exchange 2010.
Users who are still on Exchange 2003 cannot send attachments any larger than around 8MB to Exchange 2010 users on the same LAN.
Users on Exchange 2010 can send large attachments to fellow Exchange 2010 users without issue.
I do not have any quota restrictions on Exchange 2010.
Had a look at the Exchange 2003 Connector but could not see any reference to attachement restrictions.
Has anyone come across this?

Here is a note of the NDR:-
Your message did not reach some or all of the intended recipients.
Subject:
The following recipient(s) cannot be reached:
Tracey xxxxxx on 01/12/2014 13:27
This message is larger than the current system limit or the recipient's mailbox is full.
Create a shorter message body or remove attachments and try sending it again.
<mail.xxxxxxxxx.com #5.2.3 smtp;450 5.2.3 Msg Size greater than allowed by Remote Host>

RSOP: Interactive logon: Prompt user to change password before expiration

Hi,
I am trying to implement a GPO so that users are prompted to change their password 5 days before it expires. I have done this via -
Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options > Enabled
Interactive Logon: Prompt user to change password before expiration
Despite doing the above the GPO does not seem to be taking effect. I have run RSOP on my machine and a few users machines and can see that there is a red circle with an X next to
Interactive Logon: Prompt user to change password before expiration.
Below is my winlogon.log file but I am not really sure what I am supposed to be looking for. Can anyone help?
Make a local copy of \\**************.co.uk\sysvol\**************.co.uk\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf.
GPLinkSite GPO_INFO_FLAG_BACKGROUND )
Make a local copy of \\**************.co.uk\sysvol\**************.co.uk\Policies\{91EDC47D-AACF-4DFE-B044-5D29500CECBE}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf.
GPLinkDomain GPO_INFO_FLAG_BACKGROUND )
Make a local copy of \\**************.co.uk\SysVol\**************.co.uk\Policies\{DDE2DDB7-9802-415B-819E-1ADA496DC3E6}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf.
GPLinkDomain GPO_INFO_FLAG_BACKGROUND )
Make a local copy of \\**************.co.uk\sysvol\**************.co.uk\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf.
GPLinkDomain GPO_INFO_FLAG_BACKGROUND )
Make a local copy of \\**************.co.uk\SysVol\**************.co.uk\Policies\{6422C1A4-D958-4F4B-A8AA-EBACC567BD19}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf.
GPLinkOrganizationUnit GPO_INFO_FLAG_BACKGROUND )
No template is defined in GPO \\**************.co.uk\SysVol\**************.co.uk\Policies\{43F654AA-56D5-4F2C-B357-1AFEE03D37F2}\Machine.
Process GP template gpt00000.inf.
This is not the last GPO.
08 March 2015 23:06:35
Copy undo values to the merged policy.
----Un-initialize configuration engine...
Process GP template gpt00001.dom.
This is not the last GPO.
08 March 2015 23:06:36
----Un-initialize configuration engine...
Process GP template gpt00002.dom.
This is not the last GPO.
08 March 2015 23:06:36
----Un-initialize configuration engine...
Process GP template gpt00003.dom.
This is not the last GPO.
08 March 2015 23:06:36
----Un-initialize configuration engine...
Process GP template gpt00004.inf.
08 March 2015 23:06:36
----Configuration engine was initialized successfully.----
----Reading Configuration Template info...
----Configure User Rights...
Configure S-1-5-32-544.
Configure S-1-5-21-778002760-1239436532-1307212239-1002.
Configure S-1-5-21-778002760-1239436532-1307212239-1016.
Configure S-1-5-21-778002760-1239436532-1307212239-4078.
Configure S-1-5-21-778002760-1239436532-1307212239-512.
Configure S-1-5-21-778002760-1239436532-1307212239-500.
Configure S-1-5-21-778002760-1239436532-1307212239-513.
User Rights configuration was completed successfully.
----Configure Group Membership...
Configure **************\Local Admins for Users.
old memberof tattoo list: *S-1-5-32-555,*S-1-5-32-544,
object already member of Administrators.
object already member of Remote Desktop Users.
new memberof tattoo list: *S-1-5-32-555,*S-1-5-32-544,
Group Membership configuration was completed successfully.
----Configure Security Policy...
Configure password information.
Configure account force logoff information.
System Access configuration was completed successfully.
Configure machine\software\microsoft\windows nt\currentversion\winlogon\passwordexpirywarning.
Configure machine\software\microsoft\windows\currentversion\policies\system\enableinstallerdetection.
Configuration of Registry Values was completed successfully.
Audit/Log configuration was completed successfully.
----Configure available attachment engines...
Configuration of attachment engines was completed successfully.
----Un-initialize configuration engine...
this is the last GPO.
Make a local copy of \\**************.co.uk\sysvol\**************.co.uk\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf.
GPLinkSite GPO_INFO_FLAG_BACKGROUND )
Make a local copy of \\**************.co.uk\sysvol\**************.co.uk\Policies\{91EDC47D-AACF-4DFE-B044-5D29500CECBE}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf.
GPLinkDomain GPO_INFO_FLAG_BACKGROUND )
Make a local copy of \\**************.co.uk\SysVol\**************.co.uk\Policies\{DDE2DDB7-9802-415B-819E-1ADA496DC3E6}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf.
GPLinkDomain GPO_INFO_FLAG_BACKGROUND )
Make a local copy of \\**************.co.uk\sysvol\**************.co.uk\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf.
GPLinkDomain GPO_INFO_FLAG_BACKGROUND )
Make a local copy of \\**************.co.uk\SysVol\**************.co.uk\Policies\{6422C1A4-D958-4F4B-A8AA-EBACC567BD19}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf.
GPLinkOrganizationUnit GPO_INFO_FLAG_BACKGROUND )
No template is defined in GPO \\**************.co.uk\SysVol\**************.co.uk\Policies\{43F654AA-56D5-4F2C-B357-1AFEE03D37F2}\Machine.
Process GP template gpt00000.inf.
This is not the last GPO.
09 March 2015 16:26:51
Copy undo values to the merged policy.
----Un-initialize configuration engine...
Process GP template gpt00001.dom.
This is not the last GPO.
09 March 2015 16:26:51
----Un-initialize configuration engine...
Process GP template gpt00002.dom.
This is not the last GPO.
09 March 2015 16:26:51
----Un-initialize configuration engine...
Process GP template gpt00003.dom.
This is not the last GPO.
09 March 2015 16:26:51
----Un-initialize configuration engine...
Process GP template gpt00004.inf.
09 March 2015 16:26:51
----Configuration engine was initialized successfully.----
----Reading Configuration Template info...
----Configure User Rights...
Configure S-1-5-32-544.
Configure S-1-5-21-778002760-1239436532-1307212239-1002.
Configure S-1-5-21-778002760-1239436532-1307212239-1016.
Configure S-1-5-21-778002760-1239436532-1307212239-4078.
Configure S-1-5-21-778002760-1239436532-1307212239-512.
Configure S-1-5-21-778002760-1239436532-1307212239-500.
Configure S-1-5-21-778002760-1239436532-1307212239-513.
User Rights configuration was completed successfully.
----Configure Group Membership...
Configure **************\Local Admins for Users.
old memberof tattoo list: *S-1-5-32-555,*S-1-5-32-544,
object already member of Administrators.
object already member of Remote Desktop Users.
new memberof tattoo list: *S-1-5-32-555,*S-1-5-32-544,
Group Membership configuration was completed successfully.
----Configure Security Policy...
Configure password information.
Configure account force logoff information.
System Access configuration was completed successfully.
Configure machine\software\microsoft\windows nt\currentversion\winlogon\passwordexpirywarning.
Configure machine\software\microsoft\windows\currentversion\policies\system\enableinstallerdetection.
Configuration of Registry Values was completed successfully.
Audit/Log configuration was completed successfully.
----Configure available attachment engines...
Configuration of attachment engines was completed successfully.
----Un-initialize configuration engine...
this is the last GPO.
Jeet S

******UPDATE******
I think I have managed to get this working. I changed the source of the policy to a different GPO. I then did the following -
From a command prompt run gpupdate (without the force parameter)
Ran rsop.msc and checked the policy and this time there was no red circle with an X
Have done the same on a few users machines and it appears to apply successfully. I say this because when you go into the properties for the policy you see the following -
The policy XYZ was correctly applied
Just have to wait and see if it actually does what it says on the can.
Jeet S

OIM AD Integration - 'User must change password at next logon'

Hi,
These are the issues in OIM AD integration that we are stuck up on:
Issue:
1. When OIM Admin resets the password for User1 in OIM, the password is propagated to AD but the ‘User must change password at next logon’ attribute is not updated in AD. As a result, if the User1 logs into AD account (i.e. computer), there is no prompt to change the password.
2. When AD Admin resets the password for User1 in AD and checks the ‘User must change password at next logon’ flag, the password is propagated to OIM but the ‘obpasswordchangeflag’ attribute (of oblixPersonPwdPolicy class) is not updated in OID. As a result, if the User1 logs into OIM account, there is no prompt to change the password.
Research:
1. For case 1 above: When OIM Admin resets the password for User1, the ‘User must change password at next logon’ attribute on the AD process form itself is not getting updated. So the AD Connector doesn’t propagate the attribute to AD.
2. For case 2 above: When the AD Admin resets the password for User1 in AD, the AD Password Sync connector only sends the password to OIM and not other attribute. So, there is no way to fetch the ‘User must change password at next logon’ attribute and then copy it into ‘obpasswordchangeflag’ attribute in OID.
Environment Details:
1. OIM-OAM-OAAM 11.1.1.5 BP02 integrated using OVD-OID 11.1.1.5
2. AD on WIN 2008 R2.
3. OIM AD Connector 9.1.1.7.2
4. AD Password Sync Connector 9.1.1.5
Any help would be highly appreciated!
Thanks,
Kulesh...

Thanks for your reply again.
I did not get you completely here. Can you please elaborate on the "process task on the AD Process which passes along the USR_PWD_MUST_CHANGE and immediately sets it to 0 this should work". How many total additional tasks would be needed here?
what all targets are you provisioning the password to?
- AD and OID (through LDAPSYNC)
where are end users allowed to change their passwords on (OIM,AD....??)
- Both OIM and AD.
Where can admins change the passwords?
- Currently they use ARS for such purposes but this is something we need to clearly define. The thing is, they use ARS for whole lot of purposes and we can't dictate/restrict them to use OIM only for password resets. So they may use ARS or OIM.
What do you suggest?
Edited by: Kulesh Kane on Nov 8, 2012 11:43 AM

User must change password at next logon?

Hello,
We have an XMII / LDAP connection to AD. (Both read and write). But when ever we set a user in our AD to change password at next logon, they get block from logging into Xmii.
The funny part about this is if we do the following:
1: User login into Xmii
2: Administratator on AD controller, sets the flag "User must change password on next logon"
3: User selects Logout.
Now the user gets promt of changing his/her password.
Anyway to fix this?

Well we have some clients that doesn't use the same login to MII and for their workstation.
Basicly i want so whenever i set the flag "User must change password at nextlogon" in AD, I want MII to see that and make the user change his or her password in the portal.

Exchange 2010 users cant change password in OWA when Cas server is Exchange 2013 cu3

Similar Messages

Maybe you are looking for