"Woodworm" wrote:

> We have an irritating problem - when a user's password is near to expiring
> Windows asks them if they want to change it, but if they try to it tells them
> they do not have permission.
>
> If they log in with the old password, then change it, everything works fine
> - which is OK unless their password has already expired!
>
> We are a mixture of Windows XP and Windows 2000 logging in to two Windows
> 2003 servers sharing an Active Directory.
>
> Any ideas please?

"seree" wrote:

> Sounds like a setting in Group Policy is stopping users from changing
> passwords. Look in your Group Policy Object and see if a setting was
> incorrectly assigned in this area.
> --
> seree
>
>
> "Woodworm" wrote:
>
> > We have an irritating problem - when a user's password is near to expiring
> > Windows asks them if they want to change it, but if they try to it tells them
> > they do not have permission.
> >
> > If they log in with the old password, then change it, everything works fine
> > - which is OK unless their password has already expired!
> >
> > We are a mixture of Windows XP and Windows 2000 logging in to two Windows
> > 2003 servers sharing an Active Directory.
> >
> > Any ideas please?

"Woodworm" wrote:

> I agree entirely - but which setting! I have looked and looked for hours and
> not found a relevant one.
>
> "seree" wrote:
>
> > Sounds like a setting in Group Policy is stopping users from changing
> > passwords. Look in your Group Policy Object and see if a setting was
> > incorrectly assigned in this area.
> > --
> > seree
> >
> >
> > "Woodworm" wrote:
> >
> > > We have an irritating problem - when a user's password is near to expiring
> > > Windows asks them if they want to change it, but if they try to it tells them
> > > they do not have permission.
> > >
> > > If they log in with the old password, then change it, everything works fine
> > > - which is OK unless their password has already expired!
> > >
> > > We are a mixture of Windows XP and Windows 2000 logging in to two Windows
> > > 2003 servers sharing an Active Directory.
> > >
> > > Any ideas please?

"seree" wrote:

> There is a setting in Local Users and Groups in each account which stops
> users from changing passwords. Go to Administrative Tools in All Programs,
> then select Computer Management. In Computer Management open Users and
> Groups, then click on Users, then double click on a user and check if the box
> for stopping the user from changing the password is checked. If it is checked
> uncheck it and click ok. Then go into each user account you have and so the
> same. If this box is not checked I am out of suggestions, and perhaps
> somebody else will  have more to offer. Good luck and I hope this fixes your
> problem,
> --
> Seree
>
>
> "Woodworm" wrote:
>
> > I agree entirely - but which setting! I have looked and looked for hours and
> > not found a relevant one.
> >
> > "seree" wrote:
> >
> > > Sounds like a setting in Group Policy is stopping users from changing
> > > passwords. Look in your Group Policy Object and see if a setting was
> > > incorrectly assigned in this area.
> > > --
> > > seree
> > >
> > >
> > > "Woodworm" wrote:
> > >
> > > > We have an irritating problem - when a user's password is near to expiring
> > > > Windows asks them if they want to change it, but if they try to it tells them
> > > > they do not have permission.
> > > >
> > > > If they log in with the old password, then change it, everything works fine
> > > > - which is OK unless their password has already expired!
> > > >
> > > > We are a mixture of Windows XP and Windows 2000 logging in to two Windows
> > > > 2003 servers sharing an Active Directory.
> > > >
> > > > Any ideas please?

"Woodworm" wrote:

> Thanks for trying, but because we use domain logons and Active Directory
> there are no users in the local user list!
>
> And no, they are not individually restricted from changing their passwords
> in Active Directory. They can change their password, but not until they have
> successfully logged on.
>
> "seree" wrote:
>
> > There is a setting in Local Users and Groups in each account which stops
> > users from changing passwords. Go to Administrative Tools in All Programs,
> > then select Computer Management. In Computer Management open Users and
> > Groups, then click on Users, then double click on a user and check if the box
> > for stopping the user from changing the password is checked. If it is checked
> > uncheck it and click ok. Then go into each user account you have and so the
> > same. If this box is not checked I am out of suggestions, and perhaps
> > somebody else will  have more to offer. Good luck and I hope this fixes your
> > problem,
> > --
> > Seree
> >
> >
> > "Woodworm" wrote:
> >
> > > I agree entirely - but which setting! I have looked and looked for hours and
> > > not found a relevant one.
> > >
> > > "seree" wrote:
> > >
> > > > Sounds like a setting in Group Policy is stopping users from changing
> > > > passwords. Look in your Group Policy Object and see if a setting was
> > > > incorrectly assigned in this area.
> > > > --
> > > > seree
> > > >
> > > >
> > > > "Woodworm" wrote:
> > > >
> > > > > We have an irritating problem - when a user's password is near to expiring
> > > > > Windows asks them if they want to change it, but if they try to it tells them
> > > > > they do not have permission.
> > > > >
> > > > > If they log in with the old password, then change it, everything works fine
> > > > > - which is OK unless their password has already expired!
> > > > >
> > > > > We are a mixture of Windows XP and Windows 2000 logging in to two Windows
> > > > > 2003 servers sharing an Active Directory.
> > > > >
> > > > > Any ideas please?

"Ian" wrote:

> "Woodworm" wrote:
>
> > We have an irritating problem - when a user's password is near to expiring
> > Windows asks them if they want to change it, but if they try to it tells them
> > they do not have permission.
>
> Actually this is an age-old chestnut that goes back to at least NT4 days.
> Server OSs and XP Pro by default force a password-change every 42 days, yet
> they also allow you to set a conflicting policy disallowing password changes.
> This of course results in the failure of the computer when the password
> expires, and this might occur under very awkward circumstnaces, such as on
> location with a laptop. 
>
> As the password-expiry is not the work of the person installing the computer
> (and in fact its existence is never notified to him)  it is surely therefore
> the responsibility of the coder to warn of the conflict when a policy is set
> restricting who can change passwords.
>
> It's high time this oversight was corrected.
>
>