Self Service Password Reset

[dezt]

Still not sure what ADODB is / or how to set it up.

ASP seems to be ok but I still get a page not found when i navigate to the web page.

[Diello]

Just implemented here - brilliant! Thank you

[plexer]

Ok if anyone wants to try this out please do and let me know if it works for you or not.

I think I may have made a mistake in the directory structure of my last zip file.

I had trouble attaching it to the post so I've upped it to my website

http://www.plextech.co.uk/SSPR2.0.1-b1.zip

Ben

[boomam]

Got a bit further.
Still not working though.

Ive setup two user accounts.
One called "resetpassword" thats a normal user, set to load IE as the GUI as specified in the readme.
The other is a domain admin called "resetpasswordadmin".

I can load the first interface logged in as my test pupil, with the address: "http://server:81/register/register.asp". Problem is there that the 'username' box appears blank, but everything goes through without error.

If goto the reset page, enter the test pupil account that i previously registered, to which it says that the user isnt registered?
So i go back to the register page, and aparentely its already registered!?

Is there a more indepth install guide around anywhere? Because while the 'quick install one' is there, half the information on it is incorrect in my case, running the IIS manager that comes with R2. So im having to wing half of it, guessing as i go along.

Just to check, the two accounts ive setup, the standard user one is for....kiosks?
And the domain admin one is for the program itself to have access to change the passwords?


If someone could help me get this working, it would be VERY much appriciated. .

[plexer]

Ok I will install R2 on my test 2003 DC and see what the differences are.

I will take some screen shots as I install and configure it and make a pdf guide for it.

I'll post it when it's done, I need to do this anyway as I want to release it to the wider world.

You don't need the resetpassword user to test if it working you can go to http://servername/reset/index.asp as your normal user and that will run the same reset password pages.

Ben

[boomam]

Ok I will install R2 on my test 2003 DC and see what the differences are.

I will take some screen shots as I install and configure it and make a pdf guide for it.

I'll post it when it's done, I need to do this anyway as I want to release it to the wider world.

You don't need the resetpassword user to test if it working you can go to http://servername/reset/index.asp as your normal user and that will run the same reset password pages.

Ben

Thanks.
Looking forward to the guide. I think this app has the potential for good things for IT admins..

[dezt]

OK, i'm having a thick day today, just downloaded the 2.0.1-b1 version and followed the instructions in the readme file, everything seems to be working fine now, i hadn't set active server pages to allow, just asp.net in extensions.

Thanks for this really good useful tool.

[plexer]

dezt: Glad to have helped you get it working.

Let me know how you get on with using it please.

Ben

[rvdmast]

@ BOOMAM,
Like plexer said, my setup allows pupils to access the reset-pages from the windows login screen without having to login first. It display's an extra button below the "press CTRL-ALT-DEL..." dialog that opens the reset pages in a tightly restricted full screen browser.

Right now i am a little short of time, but i've already promised plexer i'll post
a description how i achieved this in this thread, later this week or next week.
So sit tight...

[boomam]

Thanks.
Helpfull community this is. .

[Irazmus]

It's been quite a while since I last posted so be warned this may be a long one.

I noticed that on the update page, once you filled everything in correct, the redirection to the next page (\register) didn't work.

I can't believe I overlooked that, I've updated update_details.asp and the installation instructions to fix that.

I'm still having problems reaching the admin pages from remote computers.

I've made quite a few changes to the admin pages, hopefully that should have solved the problem, if not let me know and I'll see what I can find.

I've taken a different aproach here: with the help of some free tools and a compiled autoit script i made i've been able to set up a kiosk machine where there are 2 extra buttons on the login screen (where it says press CTRL+ALT+DEL) which open a full screen browser (kiosk mode) to either the password reset page or our printer accounting page.

I would love to see how you did that, it would make the system so much easier than having to run it from a separate logon.

Is there a more indepth install guide anywhere?

I'm working on a screencast of a basic deployment as a more descriptive install guide which I hope to post in the next few days.
One question though, are you running SSPR on a DC or a member server?
Until recently I've only tried SSPR running on DCs, but I've just moved it to a member server while reorganizing the network, and have found that SSPR breaks rather badly if it's not on a DC (it can't reset passwords due to the 2 hop limitation inherent in NTLM). The fix for this bug is in the latest version below.

[Irazmus]

New SSPR release

Plexer and I managed to get out of line with our version numbers so this release is rather oddly version 2.2.1, and no you didn't miss 2.1 and 2.2 as they were superceded before I released them ^^;
This release includes Plexer's changes in 2.0.1-b1, which in my timeline fall in 2.2


** Change Log v2.2.1 **
--------------------------------------------------------------------------------
* Added admin reset counter & last admin reset date to user details in admin console
* Added new table userdata to database to record last admin reset date and total number of admin resets per user
* Added Password Last Set to administration console

** Change Log v2.2 **
--------------------------------------------------------------------------------
* Modified admin\auth.asp to convert all group names to lower case to prevent case sensistive errors.
* Fixed problem where password cannot be changed if IIS is not running on a Domain Controller
* Added impersonation settings to config.asp for use with above fix
* Added LoginAdmin.dll for use with above fix
* Corrected error where update_details.asp was ignoring setting of HashAnswers
* Replaced all occurances of Response.Redirect "/register" with Response.Redirect "/register/register.asp"
* Removed evil hacks from reset_pass.asp and adminreset.asp, replaced with proper error checking

** Change Log v2.1 **
--------------------------------------------------------------------------------
* Added option for user answers to be held in plain text rather than hashed


[ Information for those updating an existing install ]

* Important config changes *
Pages in the reset directory no longer need to be run with elevated privileges in IIS as 2.2 uses inline impersonation to modify AD
Members of the resetGroup and adminGroup no longer need privileges to reset passwords in AD
There is a new file cred.ini which needs to contain logon credentials for an account with AD premissions to reset passwords
A new dll, LoginAdmin.dll, needs to be registered to allow SSPR to impersonate the user detailed in cred.ini when changing passwords in AD
The database has a new table which is needed by the admin pages. If upgrading an existing install this table will need to be added to the database manually

Table : userdata
	username	text
	resetcount	int
	resetdate	text

Alternatively you can rob it from the included reset_db.mbd

* New files *
LoginAdmin.dll
cred.ini
wwwroot/iniread.asp

* Changes to config.asp *

CredFile = "c:\Inetpub\cred.ini"

Location of credentials file for impersonation.
Located outside web directories for security
[code]HashAnswers = False[code]
Are user's answers stored hashed or plaintext? Hashed increases security, plain text helps with admin authentication when kids forget how they spelled their answers

%>
<!--#include virtual="/iniread.asp"-->
<%
ImpersonateUser = ReadINI(CredFile, "Main", "ImpersonateUser")
ImpersonateUserPass = ReadINI(CredFile, "Main", "ImpersonateUserPass")
%>

Reads contents of CredFile

[ / Information for those updating an existing install ]


I'm pretty sure there are no major bugs, but please post back if you find one.

EDIT: File updated to fix error in auth.asp

[boomam]

One question though, are you running SSPR on a DC or a member server?
Until recently I've only tried SSPR running on DCs, but I've just moved it to a member server while reorganizing the network, and have found that SSPR breaks rather badly if it's not on a DC (it can't reset passwords due to the 2 hop limitation inherent in NTLM). The fix for this bug is in the latest version below.

I have it installed on a seperate IIS to the DC. .

[Irazmus]

I have it installed on a seperate IIS to the DC. .

That's at least part of the problem then. Give 2.2.1 a try and see if that solves things for you.

[boomam]

That's at least part of the problem then. Give 2.2.1 a try and see if that solves things for you.

Im not sure i'll have time at the moment, so it'll be a while before i get the chance..