Password Reset Help - Active Directory permission

[FN-GM]

Hi

 

I have made a script that will allow teachers to reset passwords. It will check the OU of the concerned account to check if it is a student account, that bit works fine. The script works perfectly for administrators. But for non-administrators i get the attached error message. I think it is permissions concerning active directory, how do i give access to reset passwords to certain a group please?

 

Thanks

[cromertech]

I did it the other way round and prevented student from changing their passwords with a group policy. see attached screen for location

[Edu-IT]

I did it the other way round and prevented student from changing their passwords with a group policy. see attached screen for location

I don't think that is the right thing. Going on the questions Zak has asked before it seems as though this script allows staff to change the password of any student.

 

Might be irrelevant but what is the code on line 60?

[FN-GM]

on line 60 is the part where it changes the password. We don't let students change their own passwords but they still forget them. We are out of the office allot so don't get chance to reset them you see.

 

Z

[strawberry]

have you delegated permission for staff to change passwords?

[rob_f]

Just to follow up on strawberry's remark, objects in active directory have permissions in exactly the same way that files do on NTFS volumes. If you look at the security tab on the properties of an OU (i.e. your students OU) you can see the permissions. To set the change password permission, go to advanced then add/edit the user you wish to grant the permission to and select "Apply onto: user objects" from the dropdown.

 

IIRC you need to allow "change password", "reset password" and possibly one other to allow users to set the "change password on next logon" as this temporarily alters the object's password expiration settings.

[FN-GM]

Thanks alot i will give that a go tomorrow

 

Thanks

 

Z

[FN-GM]

Just to follow up on strawberry's remark, objects in active directory have permissions in exactly the same way that files do on NTFS volumes. If you look at the security tab on the properties of an OU (i.e. your students OU) you can see the permissions. To set the change password permission, go to advanced then add/edit the user you wish to grant the permission to and select "Apply onto: user objects" from the dropdown.

 

IIRC you need to allow "change password", "reset password" and possibly one other to allow users to set the "change password on next logon" as this temporarily alters the object's password expiration settings.

 

I have just done that but the same problem. I gave the staff usergroup "change password" & "reset password" rights.

[strawberry]

might be a silly question, but did you log off and back on again?

[FN-GM]

Yer, i doubt re-starting the domain controllers will do anything will it?

[ChrisH]

No it wont do anything but you can force replication under sites and services but tbh it normally replicates before you get the MMC open. Logging off and on again will renew your access token which you will need to do in this case more than likely.

[FN-GM]

Hi

 

I have forced replication but the same problem. I have also tried loggin on then back off again.

 

Thanks for your suggestions

 

Z

[rob_f]

To eliminate a problem with your script, install the Windows Server 2003 Administration Pack on a teacher's machine, which gives them Active Directory U&C. They should then be able to launch ADU&C and reset passwords under the OU for which you have changed the permissions, if the perms are indeed correct.

 

 

Rob.

[FN-GM]

Ok i will give that a go on friday, my day off tomorrow.

 

Z

[FN-GM]

Sorry for the slow comeback. It will only let the teacher reset the password not check the box “user must change password at next logon” I’m unsure how to allow it.

 

Thanks

 

Z

[rob_f]

IIRC if you have password expiration set up (or possible the "password never expires" option checked) then this will be the case. There is another permission that needs to be set to allow the password expiration to be altered temporarily (which is what you are doing behind the scenes when you tick the change password at next logon).

 

Not quite sure which one it is without having a proper look, money is on one of the items in the user objects dropdown, however it might only be a permission exposed through ADSI edit. Have a play, if you're still stuck give us a shout.

 

Rob.

Edited May 19, 2008 by rob_f

[FN-GM]

Sounds abit soon but i am stuck, i have been playing since i made my last post with no result. We have no password eexpiration setup.

 

Thanks for all your help

 

Z

[rob_f]

Sorry, edited my post whilst you were posting:

 

If you have the "password never expires" option checked this may also grey out the change password on next logon for staff.

 

 

Rob.

[FN-GM]

Sorry, edited my post whilst you were posting:

 

If you have the "password never expires" option checked this may also grey out the change password on next logon for staff.

 

 

Rob.

 

Nope thats not checked.

 

Thanks

 

Z

[maniac]

I've found the only way this works properly is to give staff 'Account Operator' privledges in Active Directory. This allows them to change users passwords, but not administrators passwords obviously!

 

It is quite a high permission to give, as potentially they can affect any Users account on the system, but it's the only way we can get it to work. To stop this our password reset program is multiple choise, so they can't change staff passwords.

 

Mike

[ChrisH]

I had trouble using the delegation wizard it wouldnt let the staff I delegated to change the passwords. I ended up setting the permissions manually on the users. it was something like there were 2 different setting such and change password and reset password.