Migrating from server 2003R2 to 2008R2 User cannot change password box unchecks after being checked.

After Migrating the domain controller from server 2003 R2 to 2008 R2 the check box for users cannot change password wont stay checked. This is happening to ALL users and no they are not a member of any Protected Groups. I have searched for a solution
for months but cant not find.
And now after migrating the exchange 2003 to 2010 I have to keep applying the inherited permissions every hour until a user finally makes an active sync.
Now having more AD issues, cant remove users from Exchange 2010...And again have to go to the DC and applying the inherited permissions, then I can remove the user.
I really need help with this...
John

Hi,
Did you use the migration tools to do the user migration?
Permissions on a user that is migrated from an Active Directory domain are reset to default values during migration.
I think this is by design:
http://technet.microsoft.com/en-us/library/cc974359(v=ws.10).aspx
Regards.
Vivian Wang

Similar Messages

How to set "User cannot change password" on W2K accounts.

Hi gurus,
I need to set (from create user form) "User cannot change password" on W2K accounts.
I was expected that some value of userAccountControl attribute on AD could do the job, but I realized that it is not so (look also to http://forum.java.sun.com/thread.jspa?threadID=593193&messageID=3108889).
Thanks for any suggestion.

Yeah thats right, I have implemented the same using nTSecurityDescriptor attribute

User cannot change password option is automatically getting unchecked while giving domain admin rights

user cannot change password option is automatically getting unchecked while giving domain admin rights

Greetings!
"Domain Admins" falls into the category of protected groups and it is included in ADminSDHolder process. It is normal and was designed in order to prevent the modification to these privileged groups. More information on the link below:
AdminSDHolder, Protected Groups and SDPROP
Regards.
Mahdi Tehrani |
|
www.mahditehrani.ir
Please click on Propose As Answer or to mark this post as
and helpful for other people.
This posting is provided AS-IS with no warranties, and confers no rights.
How to query members of 'Local Administrators' group in all computers?

2012 R2 RD Session Host Domain Users Cannot Change Password

I set up a Windows 2012 R2 Session Host as per
http://support.microsoft.com/kb/2833839 and joined it to the domain. Now, users are unable to change their password. When they log in to the RDSH and "ctrl-del-end", they are given the change password dialog, but they are told that
their password "doesn't meet complexity requirements" even if it does. I suspect the issue is related to the fact that there is no "session collection" per se and that the "connection broker" role is not installed.
Is there any way around this? The end game would be to have them log into this RDSH and be able to change their password to conform with the domain password policy
PaulK

Hi Paulk,
Did you mean that all users cannot change passwords? Based on my experience, this issue was not related ro the RD connection broker role.
Please check the password policy in group policy of the domain to see if any password policy caused this issue:
Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy
For more information, you can refer to the link below:
https://technet.microsoft.com/en-us/library/hh994572(v=ws.10).aspx
Best regards,
Susie
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

Users Cannot Change Passwords on a Server 2012 R2 RDS Farm

Hello I have a Server 2012 R2 RDS Farm consisting of 1 server that has connection broker and gateway configured and 4 RDS Session Hosts. The works great I even have a separate remote app farm to distribute the apps to the servers, my main issue is passwords
and the lack of the EU ability to change these, listed below are my symptoms.
Users password has expired denied logon instantly with no ability to change password.
User tries to change password whilst in 30 day warning period using ctrl alt end the user is advised the password does not meet complexity requirements I have checked this and they do meet them.
Expired passwords can be changed via the RDWeb site however this is not an option for us.
Chris

Hi,
Firstly, based on my knowledge, remote users may have to change their passwords before expired. If not, they have to use OWA or logon on locally to change their passwords.
Regarding the issue, please let us know if the following policies are enabled in your domain.
Enforce password history
Minimum password age
Also, does a local domain user have the same issue?
Thanks.
Jeremy Wu
TechNet Community Support

User cannot change password

Users can log on fine to the 10.4 server (new install) from 9.2 clients with their current passwords, but if they try to change their password they get the following error:
"unknown user, incorrect password or log on is disabled"
BTW, logins are not disabled obviously
ideas? Thanks, Tom

Hi,
just for your information: Re: Change password on the first use - does not work

Lion Server: Users Cannot Change Password

I'm not sure how long this has been the case, as we don't have a ton of users. We recently added a new user, and directed her to our website to change her password (the only service she needs is email), and she gets a window that clearly is not being presented correctly from the server. When you look at the screen, you see that the window title and fields for the user to enter their current name and password list what looks like programming references rather than user-friendly titles.
Even if you enter information and click the button, it gives you the error about the password server not being reached.
Has anyone seen similar issues to this?
Thanks in advance!

isolate it further.
does this occur for this user only? (test other users)
add a new user to see if its related only to newer users
verify your dns, what are the results of the following form terminal: sudo changeip -checkhostname"
Jeff

Exchange 2010 user cannot change password from OWA

My users are not able to change their own email password from owa. But we can change the passwords from ECP or from the server without any issue. What could be the issue ?
Biju Rajan

Check the regional date and time is set for user OWA...Follow the below steps
On the Client Access Server (CAS), click Start > Run and type
regedit.exe and click OK.
Navigate to HKLM\SYSTEM\CurrentControlSet\Services\MSExchange OWA.
Right click the MSExchange OWA key and click New >
DWord (32-bit).
The DWORD value name is ChangeExpiredPasswordEnabled and set the value to
1.
Note: The values accepted are 1 (or any non-zero value) for "Enabled" or 0 or blank / not present for "Disabled"
After you configure this DWORD value, you must reset IIS. The recommended method to reset IIS is to use
IISReset /noforce from a command prompt.
Ref:http://blogs.technet.com/b/exchange/archive/2010/10/06/3411240.aspx
Exchange Queries

Windows 8.1 cannot change password in Windows 2003 domain level domain

On several installations of windows 8.1 enterprise, users cannot change passwords by using <ctrl> + <al> + <del> keys and choosing change password.
The error is: "The security database on the server does not have a computer account for this workstation trust relationship"
Fresh Windows 8.1 enterprise installs with no patches to fully patched windows 8.1 enterprise workstations have the problem. Backed out patches one by one and tested password change without success. Tried various dell laptops, tablets, and workstations
but same issue. Tried VMware guest workstation with windows 8.1 enterprise. The domain functional level is 2003 with a mixture of Windows 2008 R2 DC's and Windows 2003 DC's.
The add/remove from domain did not help. What troubleshooting steps should I take from this point? Is this related to secure channel failures? Note: did not find event log entries for the failures in the DC's nor on the workstation.
Perhaps I did not search for the proper entry on the DC's.

Hi,
Please find below several possible cause of error “The security database on the server does
not have a computer account for this workstation trust relationship”
Secure channel is broken (Can fix by rejoin problematic client to domain)
AD replication issue. The computer account exists on one domain controller but not others.
Duplicated SPN (seems not possible)
So, to narrow down the issue, you need to make sure the AD replication is working fine. Please run command
repadmin /showrepl * on a DC, then post the result here.
After that, please run
set l on a problematic client, then post the result here.
Moreover, please check on system event log and check if there have any related error of the issue.
Thanks.

Exchange 2013 OWA user must change password at next logon not working

Hi,
I have installed Exchange 2013 on Windows 2012 Server. I create users in ECP and select "user must change password at next logon" option. When newly created user logs in, the OWA page doesn't prompt for password change and just throws error "The
user name or password you entered isn't correct. Try entering it again"
I have enabled Change Password feature in CAS server, but still not working.
Any answers, suggestions would be great help
Regards
Sunil

Hi Sunil,
Have you tried as Martina said and does it work?
If not, please try to set the Minimum Password Age to 1 according to link below. I found some threads which are similar to yours and were solved by this way in Exchange 2013 environment.
http://support.microsoft.com/kb/827614
And for further troubleshooting, please create a new user with "user must change password at next logon" option checked and see if he can log on domain-joined PC.
In addition, please check the event log to see if there is any related error message.
Regards,
Rebecca

Network account - Having "user must change password at nex logon checked" - does not allow user to login

Hi,
We have several SharePoint 2013 sites which, when the option called "User must change password at next logon" is checked on a user's Active Directory account, the user is not allowed to login to the SharePoint site. Is this something that needs
to be changed on the SharePoint end to resolve?
thanks,
Sherazad.
Sherazad

You need to look at a different solution that allows this, e.g. home-grown solution, 3rd party, and I believe Forefront Identity Manager can also accomplish this task. There are quite a few self-service password management solutions out there. Search on
that term, and you should be able to find something that works for you.
Trevor Seward
Follow or contact me at...
This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

Migrate from Server 2003 (no Exchange, single server) to SBS 2011

Are there any Technets or other Microsoft documentation on migrating from Server 2003 (no Exchange, single server) to SBS 2011? I understand it is possible, but I would like confirmation and some documentation before purchasing the appropriate hardware
and licenses.
Thanks,
Doug
Doug Orr

Hi Doug,
In general, the migration is the similar with migrating process from SBS 2003. In addition, also have main
difference.
“The main difference is that you don’t have to remove the source and that you have to follow the migration
instructions as the SBS migration wizard will not launch.”
You can get above description from following similar thread. Please refer to.
Migrate from Windows Server Standard 2003 (not SBS) to SBS 2011
http://social.technet.microsoft.com/Forums/en-US/68790e41-b833-4e81-8200-63852ab9e196/migrate-from-windows-server-standard-2003-not-sbs-to-sbs-2011?forum=smallbusinessserver
Meanwhile, please refer to the following article. It may be helpful.
Step By Step Guide To Migrating To SBS 2011
http://www.techieshelp.com/step-by-step-guide-to-migrating-to-sbs-2011/
Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft
does not guarantee the accuracy of this information.
However, as Robert suggests, would you please confirm specific version of SBS? It may help us to understand
clearly and provide correct information.
Hope this helps.
Best regards,
Justin Gu

Migrate from server core 2008 r2 hyper-v with failover cluster volumes to server core 2012 r2 hyper-v with failover cluster volumes on new san hardware

We are getting ready to migrate from server core 2008 r2 hyper-v with failover cluster volumes on an iscsi san to server core 2012 r2 hyper-v with failover cluster volumes on a new iscsi san.
I've been searching for a "best practices" article for this but have been coming up short. The information I have found either pertains to migrating from 2008 r2 to 2012 r2 with failover cluster volumes on the same hardware, or migrating
to different hardware without failover cluster volumes.
If there is anyone out there that has completed a similar migration, it would be great to hear any feedback you may have on your experiences.
Currently, my approach is as follows:
1. Configure new hyper-v with failover cluster volumes on new SAN with new 2012 r2 hostnodes and 2012 r2 management server
2. Turn off the virtual machines on old 2008 r2 hyper-v hostnodes
3. Stop the VMMS service on the 2008 r2 hostnodes
4. copy the virtual machine files and folders over to the new failover cluster volumes
5. Import vm's into server 2012 r2 hyper-v.
Any feedback on the opertain I have in mind would be helpful.
Thank you,
Rob

Hi Rob,
Yes , I agree with that "file copy " can achieve migration.
Also you can try "copy cluster wizard " :
https://technet.microsoft.com/en-us/library/dn530779.aspx
Best Regards,
Elton Ji
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected] .

ISE 1.2 Guest portal user cannot change their passwords

I have a WLC 5508(version 7.6) and a server installed the ISE (version 1.2.1.198)，Now we configured the CWA，Use guest portal as an employee and guest login url，We can use the manually create internal user and password successfully logged in, and we set up allow guest users to change password in Multi-Portal, but the user can not change the password in the guest portal ,I suspect the change password option on the Guest Portal actually works? Can anyone tell me how to change their own username password in the guest portal ?

Requiring Guests to Change Password
You can allow or require guest users to change their password after their initial account credentials are created by the sponsor. If guest users change their passwords, sponsors cannot provide guests with their login credentials if they are lost. The sponsor must create a new guest account.
You can either allow guests to change their passwords, or you can require that they do it at expiration and at first login. To require internal users using a guest portal to change their password upon their next login, choose Administration > Identity Management > Identities > Users . Select the specific internal user from the Network Access Users list and enable the change password check box.
Before You Begin
Create a Guest portal or modify the DefaultGuestPortal. This setting is specific to each Guest portal.
Step 1 Choose Administration > Web Portal Management > Settings > Guest > Multi-Portal Configuration.
Step 2 Check the Guest portal to update and click Edit .
Step 3 Click the Operations tab.
Step 4 Check either or both options:
Allow guest users to change password
Require guest users to change password at expiration and first login
Step 5 Click Save .

Windows 2008 Terminal Server "user must change password at next logon" problem with Windows 7 client.

Hi,
I have a fully patched Windows 2008 SP2 Terminal Server and a fully patched Windows 7 client.
I have logged into the Windows 2008 SP2 Terminal Server server with a test account via RDC before.
When I try to log in via RDC to the 2008 TS with a test account which has been marked with the setting "User must change password at next logon" I get the RDC message "You must change your password before logging on the first time. For assistance, contact your system administrator or technical support." I need to force the user to change their password once it has been issued, any ideas on how this can be done?
Thanks,
Dan

This does not resolve my issue all the way. I'm having the same problem; When i'm "deploying" users, i always want the users to set their own passwords. Ok, so I then set the auth mode to "RDP Security layer". It seemed to work fine, and it does for that
special purpose.
Just like Daniel, my clients are connecting to our terminal server from several/different "customer-domains" So, they can't logon locally(on their local computer) and change their password, it has to be done THROUGH the terminal server.
But if I turn on RDP Security Layer, users can't use remoteapp through tsgw they only get: "Your Remote Desktop Connection Failed because the remote computer cannot be authenticated" Any ideas?
Also, our terminal servers is round robin based in a farm. So users connect to: tsfarm.domain.com(yes, public a-record which resolves to two internal adresses) This is because, we're using a wilcard *.domain.com as SSL certificate.
But, when i'm using this, our clients sometimes get double auth when they login. I only get the double auth when tsfarm.domain.com resolves to server A, but the session broker wants the user to be on server B.(load balancing)
This does not occur when SSL is enforced, any ideas?

Migrating from server 2003R2 to 2008R2 User cannot change password box unchecks after being checked.

Similar Messages

Maybe you are looking for