Self Service Password Reset

[boomam]

If you've run the delegate authority wizard to delegate it to staff for say the students ou that should be ok.

 

Ben

I used the delegate wizard to give access to changing & reset passwords, along with account read info to all 3 SSPR objects.

Still doesnt let it through.

Very odd.

 

For the time being, ive set it to an account operator and given it a very very long password.

 

I take it that cred.ini cant be accessed by anyone in its default state?

 

Thanks.

[plexer]

Nope not unless they have admin rights and can access the c$ share on your server but in that event them accessing cred.ini is the last of your worries.

 

Ben

[boomam]

Fair enough.

Im just trying to setup a webpage in IIS that'll act as a menu, one pointing to the SSPR reset, and another to the room booking system.

But for the life of me i cant get it working.

 

My plan is to have a kiosk user, with its only startup app being IE, pointed at that menu page.

[boomam]

Am i missing something here?

Setting the enviorment to iexplore.exe & c:\program files\internet explorer\ should only start internet explorer and nothing else on login should it not?

At least it does on my NAS for my iTunes server...?

[plexer]

Why would you want your students to be able to access your room booking?

 

Not quite sure what you asking about with IE???

 

Ben

[boomam]

Why would you want your students to be able to access your room booking?

 

Not quite sure what you asking about with IE???

 

Ben

On my NAS, if i set the enviroment to an app, it would load that app only on login for that user.

I want to do the same for the kiosk machine.

Ive set it in a GP/OU that has the proxies wrong, so all it can access is the internal servers.

With the home page set at http://server/menu, that gives the kiosk machine two hyperlinks, one goes to server/reset and the other to server/booking.

The booking one still requires one further login.

 

All that i need to do is set it so only IE comes up when this kiosk username logs in. But what i did on the NAS isnt working. So im asuming i have to use some sort of generic \program files\etc path?

[boomam]

Ah ok I use:

 

"%systemdrive%\program files\internet explorer\iexplore.exe" -k http://servername/path_to_reset

 

Ben

 

Aint working.

 

In program file name i have: iexplore.exe

And in start in i have: %systemdrive%\program files\internet explorer\

 

[plexer]

In group policy I created a GPO that only applies to my passwordreset user:

 

In the GPO under custom user interface that line is specified so that it opens up that web page as the interface and nothing else.

 

Ben

[boomam]

In group policy I created a GPO that only applies to my passwordreset user:

 

In the GPO under custom user interface that line is specified so that it opens up that web page as the interface and nothing else.

 

Ben

 

In the GPO?

I cant recall a setting like that, where is it located?

As at the moment, im just trawling through a new GPO, disabling practically everything.

[boomam]

Found it.

It works beautifully. .

 

Thanks for all the help everyone. .

[plexer]

whoop.

 

Ben

[rvdmast]

I just updated to SSPR 2.2.1 and , when resetting, now i'm getting this error too:

 

Wachtwoord resetten voor XXX ...
An unexpected error occurred in the execution of this page
Please report the following information to an Administrator
Page Error Object
Error Number: -2147024891
Error Description: General access denied error 
Source: Active Directory
LineNumber: 0

 

However our SSPR_SERVER (which in our case is called PwReset) is member of domain admins. So it can hardly be a matter of rights, can it?

[edit: In fact, even using Administrator doesn't work]

 

i read that boomam had the same problem but i couldn't find a solution.

 

Does the server have to be restarted after registring LoginAdmin.dll?

Does the username in cred.ini need DOMAIN\ before it ( or @FQDN after it)?

 

[edit: Never mind after changing the username/password back again it

miraculously seems to work now...Thanks for your time]

Edited February 4, 2008 by rvdmast

[plexer]

cred.ini should not have domain or @fqdn after the username.

 

Ben

[rvdmast]

Ok so i got SSPR 2.2.1 to work again, however i noticed i still have the problem described earlier in this thread:

Whenever i wan't to load the admin pages from any computer other then the server i get:

 

Microsoft VBScript runtime error '800a0046' 

Permission denied: 'GetObject' 

/admin/auth.asp, line 33 

 

which reads:

Set UserObj = GetObject("WinNT://" & FQDN & "/" & CurrentUser & ",user")

 

Maybe this requires impersonation too?

 

Btw i'm still running it on a member server, not a DC.

Edited February 4, 2008 by rvdmast

[Irazmus]

Doh, I've just rechecked the file I uploaded and it seems I included an old copy of auth.asp.

 

I've updated the zip file but if you want to update manually, change line 33 from:

Set UserObj = GetObject("WinNT://" & FQDN & "/" & CurrentUser & ",user")

To:

Set objLogon = Server.CreateObject("LoginAdmin.ImpersonateUser")
objLogon.Logon ImpersonateUser, ImpersonateUserPass, FQDN
Set UserObj = GetObject("WinNT://" & FQDN & "/" & CurrentUser & ",user")
objLogon.Logoff
Set objLogon = Nothing

 

I don't think there are any more surprises in there anywhere, but I'll double check my live copy when I get to work in the morning.

[boomam]

Is there any point in me changing that line if it all works ok for me? .

[plexer]

boomam: I think it would be wise to do so yes, just keep a copy of the old file in case it doesn't work.

 

Ben

[rvdmast]

Doh, I've just rechecked the file I uploaded and it seems I included an old copy of auth.asp.

...

I don't think there are any more surprises in there anywhere, but I'll double check my live copy when I get to work in the morning.

 

Actualy, there were differences in adminreset.asp too (looked like impersonation stuff too) so i updated that file too.

 

The original issue is solved, thanks!.

I can now open the admin pages from other computers too.

However (you saw that coming didn't you? ) now i get another error when trying to reset a users pasword:

 

Resetting password for pwtest ...
An unexpected error occurred in the execution of this page
Please report the following information to an Administrator
Page Error Object
Error Number: 450
Error Description: Wrong number of arguments or invalid property assignment
Source: Microsoft VBScript runtime error
LineNumber: 0
Allowed Attributes: 

 

I suppose this error is in adminreset.asp but since the error message doesn't where & which line i dont know where to search.

[plexer]

Does resetting a users password by using the reset pages work?

 

Ben

[Irazmus]

That error is from adminreset.asp, it comes from

objUser.SetPassword

in the ResetPass function. For some reason it's not getting the type of value it expects.

 

A couple of things before I go hunting further:

Is it only the admin reset that fails or does the self service part fail also? | EDIT: Beaten by Ben again ^^;

Can you post the password section of your config.asp (The section including PwdType)

Edited February 5, 2008 by Irazmus

[rvdmast]

resetting a users password by using the reset pages works fine, its just the admin page that fails.

 

here is the part from my config.asp:

 

'-----------------
'Reset password can take 5 forms:
'1) a static password used for all users
'2) a list of user/password pairs
'3) a random alphanumeric srting
'4) a random password chosen from a list
'5) a password chosen by the user
'Set PwdType to the number of the method desired
PwdType = 5
'Modify the variable which corresponds to the PwdType chosen above
DefPassword = "paradise"	'Static password for all users
PasswordList = "C:\Inetpub\userpasslist.csv"		'Path to csv file containing user/password pairs
RandomPassword = 10		'Length of random password. Set to 0 for variable length using the min/max values below
RandomPasswordMin = 6	'Minimum length of random password
RandomPasswordMax = 20	'Mazimum length of random password
RandomPasswordList = "C:\Inetpub\passlist.txt"	'Path to file containing password list, 1 password per line
'-----------------
'Location of database Eg: C:\Inetpub\wwwroot\databases\reset_db.mdb
DataBase = "C:\Inetpub\wwwroot\databases\reset_db.mdb"
'-----------------
'Database Access Credentials.
'Only set these if you have protected the database. The standard database does not need these to be modified
'UserID
DBUID = ""
'Password
DBPWD = ""
'-----------------

[boomam]

boomam: I think it would be wise to do so yes, just keep a copy of the old file in case it doesn't work.

 

Ben

I think i'll stick to the mantra 'if it aint broke, dont fix it' for now. .

[rvdmast]

@irazmus & plexer: in reset_pass.asp you use:

oUser.SetPassword( NewPassword )

whereas in adminreset.asp you use:

objUser.SetPassword ("NewPassword")

???

(notice the quotes)

 

So i changed the code in adminreset to ( NewPassword ) without

the quotes and guess what: it works!

Edited February 6, 2008 by rvdmast

[Guest kerrymoralee9280]

When I log in as a test account and register for the service, it appears to register fine but when I look at the database the 'username' field is empty.

 

Any ideas anyone?

[rvdmast]

Is your test account a domain user?

In IIS manager, did you set the register, update and admin folders to Integrated Authentication and the reset folder to Anonymous ?

Are the other fields in the database being filled in?