Network account - Having "user must change password at nex logon checked" - does not allow user to login

Hi,
We have several SharePoint 2013 sites which, when the option called "User must change password at next logon" is checked on a user's Active Directory account, the user is not allowed to login to the SharePoint site. Is this something that needs
to be changed on the SharePoint end to resolve?
thanks,
Sherazad.
Sherazad

You need to look at a different solution that allows this, e.g. home-grown solution, 3rd party, and I believe Forefront Identity Manager can also accomplish this task. There are quite a few self-service password management solutions out there. Search on
that term, and you should be able to find something that works for you.
Trevor Seward
Follow or contact me at...
This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

Similar Messages

  • OIM AD Integration - 'User must change password at next logon'

    Hi,
    These are the issues in OIM AD integration that we are stuck up on:
    Issue:
    1. When OIM Admin resets the password for User1 in OIM, the password is propagated to AD but the ‘User must change password at next logon’ attribute is not updated in AD. As a result, if the User1 logs into AD account (i.e. computer), there is no prompt to change the password.
    2. When AD Admin resets the password for User1 in AD and checks the ‘User must change password at next logon’ flag, the password is propagated to OIM but the ‘obpasswordchangeflag’ attribute (of oblixPersonPwdPolicy class) is not updated in OID. As a result, if the User1 logs into OIM account, there is no prompt to change the password.
    Research:
    1. For case 1 above: When OIM Admin resets the password for User1, the ‘User must change password at next logon’ attribute on the AD process form itself is not getting updated. So the AD Connector doesn’t propagate the attribute to AD.
    2. For case 2 above: When the AD Admin resets the password for User1 in AD, the AD Password Sync connector only sends the password to OIM and not other attribute. So, there is no way to fetch the ‘User must change password at next logon’ attribute and then copy it into ‘obpasswordchangeflag’ attribute in OID.
    Environment Details:
    1. OIM-OAM-OAAM 11.1.1.5 BP02 integrated using OVD-OID 11.1.1.5
    2. AD on WIN 2008 R2.
    3. OIM AD Connector 9.1.1.7.2
    4. AD Password Sync Connector 9.1.1.5
    Any help would be highly appreciated!
    Thanks,
    Kulesh...

    Thanks for your reply again.
    I did not get you completely here. Can you please elaborate on the "process task on the AD Process which passes along the USR_PWD_MUST_CHANGE and immediately sets it to 0 this should work". How many total additional tasks would be needed here?
    what all targets are you provisioning the password to?
    - AD and OID (through LDAPSYNC)
    where are end users allowed to change their passwords on (OIM,AD....??)
    - Both OIM and AD.
    Where can admins change the passwords?
    - Currently they use ARS for such purposes but this is something we need to clearly define. The thing is, they use ARS for whole lot of purposes and we can't dictate/restrict them to use OIM only for password resets. So they may use ARS or OIM.
    What do you suggest?
    Edited by: Kulesh Kane on Nov 8, 2012 11:43 AM

  • "user must change password at next logon" flag for multiple users

    2008 R2 domain with a couple of 2012 R2 DCs.
    john.user is in the Users OU. if I right-click john.user, choose properties, go to the account tab, and check "user must change password at next logon," the next time john.user tries to log in, he gets prompted to change his password. also the
    powershell command
    get-aduser -filter * -Properties * | ? name -like "*john.user*" | select name,pwdlastset
    shows that john.user's pwdlastset is 0. all of this is as expected.
    but if I  highlight every account in the Users OU, right-click, properties, Account, "user must change password at next logon," it appears that nothing whatsoever happens. john.user doesn't get prompted to change his password at his next
    logon, and his pwdlastset is something like 130622757432306111.
    is this the expected behavior? why are the Account tab and/or the "change password at next logon" box available to me when selecting multiple users if they aren't meant to work?

    ah. thank you sir. *two* checkboxes. *two.* of course.
    I had enough OUs under my Users OU that I just used powershell to catch them all at once:
    $enabledusers = get-aduser -filter * -SearchBase "ou=users,dc=domain,dc=local" -Properties distinguishedname,pwdlastset |
        where {$_.enabled -eq "true" -and $_.distinguishedname -notlike "*ou=service accounts*"}
    foreach($enableduser in $enabledusers) {
        $enableduser.pwdlastset = 0
        Set-ADUser -instance $enableduser

  • Windows 2008 Terminal Server "user must change password at next logon" problem with Windows 7 client.

    Hi,
    I have a fully patched Windows 2008 SP2 Terminal Server and a fully patched Windows 7 client.
    I have logged into the Windows 2008 SP2 Terminal Server server with a test account via RDC before.
    When I try to log in via RDC to the 2008 TS with a test account which has been marked with the setting "User must change password at next logon" I get the RDC message "You must change your password before logging on the first time.  For assistance, contact your system administrator or technical support."  I need to force the user to change their password once it has been issued, any ideas on how this can be done?
    Thanks,
    Dan

    This does not resolve my issue all the way. I'm having the same problem; When i'm "deploying" users, i always want the users to set their own passwords. Ok, so I then set the auth mode to "RDP Security layer". It seemed to work fine, and it does for that
    special purpose.
    Just like Daniel, my clients are connecting to our terminal server from several/different "customer-domains" So, they can't logon locally(on their local computer) and change their password, it has to be done THROUGH the terminal server.
    But if I turn on RDP Security Layer, users can't use remoteapp through tsgw they only get: "Your Remote Desktop Connection Failed because the remote computer cannot be authenticated" Any ideas?
    Also, our terminal servers is round robin based in a farm. So users connect to: tsfarm.domain.com(yes, public a-record which resolves to two internal adresses) This is because, we're using a wilcard *.domain.com as SSL certificate.
    But, when i'm using this, our clients sometimes get double auth when they login. I only get the double auth when tsfarm.domain.com resolves to server A, but the session broker wants the user to be on server B.(load balancing)
    This does not occur when SSL is enforced, any ideas?

  • User must change password at next logon?

    Hello,
    We have an XMII / LDAP connection to AD. (Both read and write). But when ever we set a user in our AD to change password at next logon, they get block from logging into Xmii.
    The funny part about this is if we do the following:
    1: User login into Xmii
    2: Administratator on AD controller, sets the flag  "User must change password on next logon"
    3: User selects Logout.
    Now the user gets promt of changing his/her password.
    Anyway to fix this?

    Well we have some clients that doesn't use the same login to MII and for their workstation.
    Basicly i want so whenever i set the flag "User must change password at nextlogon" in AD, I want MII to see that and make the user change his or her password in the portal.

  • Exchange 2013 OWA user must change password at next logon not working

    Hi,
    I have installed Exchange 2013 on Windows 2012 Server. I create users in ECP and select "user must change password at next logon" option. When newly created user logs in, the OWA page doesn't prompt for password change and just throws error "The
    user name or password you entered isn't correct. Try entering it again"
    I have enabled Change Password feature in CAS server, but still not working.
    Any answers, suggestions would be great help
    Regards
    Sunil

    Hi Sunil,
    Have you tried as Martina said and does it work?
    If not, please try to set the Minimum Password Age to 1 according to link below. I found some threads which are similar to yours and were solved by this way in Exchange 2013 environment.
    http://support.microsoft.com/kb/827614
    And for further troubleshooting, please create a new user with "user must change password at next logon" option checked and see if he can log on domain-joined PC.
    In addition, please check the event log to see if there is any related error message.
    Regards,
    Rebecca

  • TMG 2010 publishing Exchange 2010 OWA cannot change password if user must change password at first logon is set

    Hi,
     I have an odd issue whereby if I set "user must change password" on an AD account, the end user cannot logon, they're simply taken back to the OWA login page as if their password is incorrect.
    My setup is as follows:
    outer TMG -- uses a listener for email.contoso.com and is configured for no authentication.This uses a publishing rule to publish the inner TMG server. This server is not a domain member.
    inner TMG - uses a listener for email.contoso.com and is configured for NLTM\kerberos negotiation with forms authentication (Windows Active Directory). This server is a domain member and use a publishing rule to publish the internal CAS. Allow users to change
    password is selected in the publishing rules.
    Exchange 2010 SP1 - uses integrated windows and basic authentication. Has the appropriate registry key configured to allow users to change their AD password on first logon.
    I've registered an snp for "http/email.contoso.com mailserver-dc1", all SSL certificates being used are valid and my configuration used to allow users to login and change their password with "user must change password on first login"
    set in AD.
    If I launch a web browser on an internal server and point it to email.contoso.com I'm immediately presented with a generic Windows authentication request (similar to what's seen in ADFS) rather than the standard OWA page. No matter what I do, I cannot login
    and change my password using the correct URL. However if I point my browser at
    http://192.168.4.10/owa I'm prompted to login and I can change my password using the sam credentials.
    The only recent changes made are:
    - Disabling SSL 3.0 and enabling TLS  (http://www.isaserver.org/articles-tutorials/configuration-security/improving-ssl-security-forefront-threat-management-gateway-tmg-2010-published-web-sites.html)
    - Replacing the TMG listener certificates so that they now use SHA2 rather than SHA2 (certificates are trusted on each TMG server)
    Looking on the outer TMG and the DC logs I can see schannel errors which I believe are related to the problem. TMG monitoring also shows "Failed connection attempt: 1907 The user'spassword must be changed before logging on for the first time"
    I've checked that my inner TMG and DC are using the same certificate for server authentication and gone through this guide:
    http://blogs.technet.com/b/keithab/archive/2012/02/29/setting-up-and-troubleshooting-ldaps-authentication-in-forefront-tmg-2010.aspx
    If I try to use ldp.exe on the inner TMG, I get the error in the pic below
    Thanks
    IT Support/Everything

    Hi,
    You could try to analyze the TMG tracing and try the troubleshoot steps in the blog below.
    TMG 2010 – FBA, troubleshooting the change password feature 
    http://blogs.technet.com/b/isablog/archive/2012/05/07/tmg-2010-fba-troubleshooting-the-change-password-feature.aspx
    Best Regards,
    Joyce

  • Number of days before user must change password.

    Hi,
    I understand how does this Essbase server setting work:
    Essbase Server Properties - Security Tab
    "Number of days before user must change password"
    But my question is:
    Does anyone know how "to mark" certain group of Users (mainly system admin accounts) - that this setting will not force periodical passoword change for "marked" users ?
    Any ideas ?
    Br, ripasso

    There are a couple of things you could do to circumnavigate this all or nothing option.
    You could write a maxl statement that would update the user profile to force the user to change their password e.g.
    alter user Fiona set password_reset_days immediate;
    I would write a program using the API that lists all users in the group and then dynamically create the maxl script that uses the statement above.
    If you can not use the API then I guess you could do a maxl only solution (using display user command) and do some text file manipulation in perl (or another scripting language).
    There are probably more solutions/ideas out there.

  • User must change password after reset?

    I am looking at the password policy settings and am wondering what "User must change password after reset� actually does. I turned it on. I tried changing some passwords in an ldap client and didnt get any messages or errors after authn again. And I didnt see a special attribute in the persons entry. Any clues?

    When the flag is enabled and the password is changed by "cn=directory manager", the next time the user authenticate, the server returns the Password Expired Control (with a Success code) and all requests other than modify of userPassword are rejected.

  • Change password on the first use - does not work

    Change password on the first use - does not work.
    Created a user and specified 'Change password on the first use' - when user logs in - the 'Change password' window does not pop- up.
    Please advise.

    (APEX 4.0.2) I am running into this same issue - if you don't set the password expiration and locking to 'Yes', the user gets into the app without being asked to change the pw.
    When you do set expiration and locking - after the user logs on with their temporary password, it does take them to the change password page (4155:50) but the username is blank. Because the username didn't get to the page the old password will never match and you get the "Invalid password" message.
    What am I missing? Anyone successful doing this?
    Simple application, default authentication, no javascript, HTTP_SERVER, no ssl.
    Thanks,
    Steve

  • WIP 330 Wireless Phone Password just showed up and does not allow Factory Default Reset

    I have a WIP 330 IP Phone and had it setup on the network fine.  When I powered it up, a phone password showed up.  The manual says the default password is "admin" but that does not work.  This phone has no reset button.  Any Ideas?

    The default login is “Admin” and password “0000”.

  • HT204350 Migration Assistant in Mavericks does not allow User account migration

    Users accounts do not show up at all.

    After a similar problem I found http://www.hardturm.ch/luz/2014/02/fixing-os-x-10-9-mavericks-migration-from-ext ernal-volume/ which explains that since Migration assistant logs you out, it also unmounts external disks. As AtlNCS Admin points out, they have a solution in using ssh and command line stuff to mount the needed disk remotely, but someone in the comments had a simpler solution: do not plug in the external firewire disk until after launchine Migration Assistant. So before running MA, eject the external disk that you want to migrate to the new machine (and unplug it) then start Migration Assistant and after selecting "migrate from an attached disk" THEN plug in the disk. It worked for me.

  • I changed my Apple id to my new e-mail address but my S4 shows my old one and does not allow me to login. How do I change my id in the phone?

    How do I change my Apple ID in my phone?

    Morning Sagardune,
    Thanks for using Apple Support Communities.
    You can sign in to another iTunes Store account on your iOS device by following these steps.
    iOS: Changing the signed-in iTunes Store Apple ID account
    http://support.apple.com/kb/ht1311
    Hope this helps,
    Mario

  • Reconciliation of "change password on next logon" from AD fails in OIM 11g

    Hello,
    We have a use case on our OIM 11g project where we create a user in Active Directory and check *"User must change password at next logon"* box in AD.
    We have setup AD as Trusted and Target resource (using connector 9.1.1.7), where users coming from AD will be created in OIM and password changes in OIM will be sent to AD. Also we use the password synchronization module (9.1.1.5) to synchronize the passwords from AD to OIM when they are changed in AD.
    What we noticed is the "User must change password at next logon" is synchronized to the "AD Resource", but unlike the regular attributes it is not accessible normally because it's a system attribute.
    What we expect is the user logging in to OIM will be prompted to change the password, but nothing happens when the newly reconciled user logs in (i.e. normal self-service page is shown). Same thing applies when we set the flag on an existing user also.
    Did anyone get this working properly?
    P.S. In a previous version it used to be the opposite where the user was constantly prompted for the password, even though it was changed in AD already, after changing the password using Alt+Crtl+Delete the user was still prompted to change when logging in to OIM. Oracle suggested we upgrade to 11.1.1.5.1 (most recent patch set) but now the reverse happens - we never get change password prompt now.
    Thanks,
    -JP
    Edited by: JacekP on Oct 17, 2011 8:10 AM

    Yeah, you're right, unfortunately we have dual authorative password model, where a user can change the password from OIM when he is accessing a OIM through a web interface or from his Windows machine through the domain controller. We need the use case to work fully both ways ideally.
    A plan-B solution is to use a directory synchronization mechanism outside of OIM that would connect OID and AD, but we would prefer not to.

  • User cannot change password

    Users can log on fine to the 10.4 server (new install) from 9.2 clients with their current passwords, but if they try to change their password they get the following error:
    "unknown user, incorrect password or log on is disabled"
    BTW, logins are not disabled obviously
    ideas? Thanks, Tom

    Hi,
    just for your information: Re: Change password on the first use - does not work

Maybe you are looking for