Self Service Password Reset

[Kevin_Beaumont]

Turned out I'd messed up and set the permissions wrong on the folders - I'd given full Anonymous access to everything, which obviously doesn't work.

[plexer]

Glad to see people are still ticking over with this.

 

Ben

[Kevin_Beaumont]

Our implementation stalled as we use thin client (Windows Server 2003, Remote Desktop to the servers) and the "Password Reset" window doesn't appear on the login screen for obvious reasons

[plexer]

Sorry can you clarify for me why it doesn't work on a thin client setup?

 

Thanks.

 

Ben

[rvdmast]

I'm guessing here, i think what he means is that SSPR itself works just fine, but the trick to get a password reset button on the login screen ( the C+A+D screen) doesn't work, because in a terminal server/thinclient environment there is no C+A+D screen.

Because the login screen is handled by the thinclient OS.

 

Just as there is no C+A+D screen when you use mstsc.exe to connect to a remote server: the login is handled by mstsc.exe

 

If he used my application to get a reset button on the login screen, it probably displays only on the login screen of the server's console.

Edited December 9, 2008 by rvdmast

[Kevin_Beaumont]

If he used my application to get a reset button on the login screen, it probably displays only on the login screen of the server's console.

 

Correctomundo! The "Password Reset" box doesn't appear on the login screen when you remote desktop in, as it's spawned on the server console (Winsta0) rather than the user display. I can't think of a way around that.

 

Well, unless somebody knows how to spawn a reset button inside of GINA...

[plexer]

Nope but the other way around it is to just have an account which people use to login with rather than just pressing on a button.

 

Ben

[Kevin_Beaumont]

Yeah, I thought about that - my managers think it is too messy for the users. The best I can think of is using pgina (pGina) to make a button on the login window.

[burgemaster]

hi all,

I am just giving this a spin, looks great !

 

I have installed as per instructions.

Register and Update both work fine, if i register it then see`s that i am in the database and goes onto the homepage etc etc

 

The update works fine, i need correct details log in and update... BUT

I am getting

 

Error: Unable to Bind to Container

 

I have tested by setting the cred.xml to use a domain admin account, and i have entered my FQDN in the config.

I am testing by running reset/index.asp logged in as a domain admin, it doesnt make any difference that im not using the locked down resetpassword account does it?

 

Any help would be great, Thanks in advance

 

We have 2 x DCs and this is installed on our dedicated IIS server

We have all out students in separate folders, ie. Top is "Schoolname Users" then folder for "Students" then inside that there are separate folders ie. Year05/6/7/8/9 with the students in.

If i login to the admin part i can see my AD details, so there must be some AD intergration. But when I verify and then try to change password i get:

 

Resetting password for XXX ...

An unexpected error occurred in the execution of this page

Please report the following information to an Administrator

Page Error Object

Error Number: 450

Error Description: Wrong number of arguments or invalid property assignment

Source: Microsoft VBScript runtime error

LineNumber: 0

Allowed Attributes:

Edited February 2, 2009 by burgemaster

[burgemaster]

I have installed onto one of our DC`s and it is working fine.

I would really prefer it on IIS, does anyone have any suggestions please?

Thanks

[akshdesh]

Getting the same message mentioned in above post. Need help !

 

Aks

[plexer]

Hi guys,

 

Ok leave it with us we'll see what we can do.

[akshdesh]

Hi

 

Any luck with the new version ? Meanwhile, I will be uploading the modified pages (Password input hash , Password confirmation box & right click disabled )

 

Aks

[akshdesh]

Anybody using this tool with DC exposed to internet ?? any fallbacks ?

[burgemaster]

Anybody using this tool with DC exposed to internet ?? any fallbacks ?

 

M$ highly recommend that IIS not be installed on a DC, and defo not to external internet. We will hopefully be launching SSR in the new school year (from our IIS server) but only if a new fix comes out from the guys

 

Cheers

[akshdesh]

Ah...I agree..publishing DC is a huge risk !

BTW figured out workaround. SSPR works smoothly on Win XP Sp2 - IIS 5.1. Builtin limit of 10 concurrent IIS sessions can be changed by below command

 

 

Cd c:\inetpub\adminscripts

Cscript adsiutil.vbs set w3svc/MaxConnections XXX (replace xxx with desired number of concurrent sessions)

iisreset

 

Admin page dosen't work for some reason on Windows XP..but it is Ok with us.

 

I don't see any issues now for taking it to production !

 

Aksh

[acraiger]

I've been looking a self password reset program, and just happened upon this thread.

The program looks really nice, if I could get it to work.

 

 

 

I've installed the program on an IIS server, and followed the instructions as best I could.

But I am unabled to reset a password.

 

I get:

Resetting password for exec1 ...

An unexpected error occurred in the execution of this page

Please report the following information to an Administrator

Page Error Object

Error Number: 450

Error Description: Wrong number of arguments or invalid property assignment

Source: Microsoft VBScript runtime error

LineNumber: 0

Allowed Attributes:

 

This is when using the Admin page.

 

When using the reset page I get:

Error: Unable to bind to container

 

Also, I've read about an instruction video, but cannot find where it is located.

Is there a pdf with screen shot instructions somewhere?

 

Any help would be greatly appreciated.

Thanks,

Craig

[plexer]

I think irazmus was going to do a video he is the person that is responsible for the code. It's a case of time. Now I've got my vm server back up and running I'll try and do some testing.

[acraiger]

I just installed on a DC, and it does work.

 

I tried it on a XP PC, as akshdesh seemed to have gotten it to work, but this gives the exact same error.

 

It just does not want to work on a stand alone IIS Server.

So I'm wondering if I just entered something incorrectly.

 

Here is my settings for the cred.ini file:

 

[Main]

ImpersonateUser=sspr

ImpersonateUserPass=Password1

[End]

 

On a DC, does the cred.ini file not get used?

[plexer]

it does sound like there is something going wrong with the impersonation which when used on a member server but not on a dc.

[deshpadeak]

Hi Craig ,

 

I got those errors when I tried this tool on Member server. because of these errors I decided to use XP as OS.

 

For errors regarding password reset :

 

> Please make sure to assign appropritate permissions to IIS virtual directories

> Loginadmin.dll is registered

> User name entered in cred.ini having sufficient permissions to reset user accounts

> Appropriate entries of domain FQDN in config.asp.

 

 

 

Aksh

 

For some unknow reasons my previous login is not working...hence using this new username !

[acraiger]

I commented out the error check where the code is highligted on reset_pass.asp:

Also commented out the Endif at bottom of coded If statement.

 

 

 

'Connect to Active Directory, reset and expire password

Set objLogon = Server.CreateObject("LoginAdmin.ImpersonateUser")

objLogon.Logon ImpersonateUser, ImpersonateUserPass, FQDN

 

Set oUser = GetObject("WinNT://" & FQDN & "/" & strusername & ",user")

'If Err.number <> 0 Then

' PageContent(0) = "Error: Unable to bind to container"

'Else

.

.

.

Set rsRegisterUser = Nothing

Set adoCon = Nothing

 

End If

'End If

 

 

And was able to do a password reset on a non-domain controller IIS server.

 

So maybe it is just a problem with the error code checking.

 

I was looking at the code all day, and I could not find anything wrong with the code.

 

I'll work on this more tomorrow, as it is time for me to get off work.

[acraiger]

I think I've gotten everything working on an IIS Server that is not a Domain Controller.

 

reset_pass.asp

 

In the function ResetPass, I added the line Err.Clear, to clear the Err value at beginning of the function.

This clears any errors codes that Err might have been set to before running this function.

The extra command is highlighted below:

 

 

Function ResetPass

'Begin Password Reset Code

Dim usr, oUser, oFlags

 

'Clear the Err holder

Err.Clear

'Connect to Active Directory, reset and expire password

Set objLogon = Server.CreateObject("LoginAdmin.ImpersonateUser")

objLogon.Logon ImpersonateUser, ImpersonateUserPass, FQDN

Set oUser = GetObject("WinNT://" & FQDN & "/" & strusername & ",user")

If Err.number <> 0 Then

PageContent(0) = "Error: Unable to bind to container"

Else

oFlags = oUser.Get("UserFlags")

.

.

 

I also updated my Adminreset.asp.

Somebody else had mentioned the quotes for ("Newpassword") on page 10 of this forum, for which. It looks like it never got fixed on the downloadable version. I checked the svn version, and it has not been updated either. It's line 213 of Adminreset.asp.

 

I'm going to do a little more testing on my Lab environment before going Live on our Corporate environment.

 

Anyways, I think this is an awsome project, and should cut down on the Helpdesk calls on Monday morning.

[badders]

I was also getting the "Error: Unable to bind to container" message. After adding the Err.Clear line in reset_pass.asp as suggested by acraiger and editing the ("NewPassword") line in Adminreset.asp I also managed to get it working on a member server running IIS.

 

Just need to test it a bit more before going live with it.

[plexer]

Fantastic guys.

 

Good work if you can let me know if that does indeed help.

 

As I said I'll get my test env up and running again and try this out then I can update the downloadable code.

 

Ben