Self Service Password Reset

[Uraken]

cheers Ben appreciated

[Uraken]

any news mate?

[plexer]

Sorry mate I just been off sick end of last week and not had a chance to look at it.

 

Ben

[Uraken]

no worrys hope you havn't had the "man Flu " thats kicking about , i had a couple of weeks ago and it knocked me for six, incidentally i tried it on a virtual server clean install no ous except default and got the same error.

[plexer]

Uraken: I've just installed it freshly here as I didn't have it installed after a recent change to my setup and it works perfectly.

 

There must be something set in password complexity in your gpo's somewhere..

 

Have another dig for me please.

 

Ben

[Uraken]

Hi Ben just reinstalled onto a new virtual server fresh install no different to the last time and it works brilliantly (after a client workstation reboot having registered?) so now i'm baffled clearly there must be something going on with my server at work but what i don't get is that i have checked all policys, run GP results wizard to see whether any policys were being applied.

Also is there no way that complexity issues can be taken into account with the self service password reset tool ( i do want my users to have fairly string passwords afterall).

[plexer]

In theory if you have complexity requirements set then as long as you choose one that meets those requirements when using the reset tool it will make them use it.

 

You could also alter the default passwords to be complex ones too.

 

There should be no reboot after registration and I don't see any way that SSPR could cause that.

 

Ben

[plexer]

Ok just done a minor bug fix that I found.

 

The only file that has actually changed is auth.asp in the wwwroot\admin\ folder so just update that if you have an exisiting installation.

 

Ben

sspr-2.0.1.zip

[t_guest]

locked down 8O

[ICTWizard]

You could also alter the default passwords to be complex ones too......

[PageZ]

Just another approach.

 

If a kid that I am teaching does the old 'sir - I've forgotten my password' routine, the first time I change it to 'password' so that they can then change it to a more secure version.

The second time of asking I change it to 'czechoslovakia'.....

 

It is amazing how few pupils forget their passwords these days...

 

Cheers

NB

[Rozzer]

Hello,

 

Everything on the script seems to be working fine. But when it comes to reset the password i get a error on page when it trys to reset the password.

 

Any ideas?

 

Excellent little program btw

 

ross

[FN-GM]

Works perfect here thanks!

[dezt]

I have tried this on a new install, but just can't get my head round it.

 

here's the situation, fresh install of iis on a windows 2003 server, I then extracted the sspr2.0.1 zip into the inetpub folder. I changed the permissions as it said in the documentation and set the config.asp file up as it says.

 

I don't know how to install / setup ADODB. any help with this would be a big help.

 

I installed ASP .net when I installed IIS.

 

when I try to navigate to http://localhost/register/register.asp I get an error saying the file cannot be found.

 

Can anyone help me please, this would be a great help and stop the kids from being sent to me to reset their passwords every 10 minutes.

[rvdmast]

in IIS manager, under Web Service Extensions, enable active server pages.

[rvdmast]

I've been setting this up today on a fresh 2003 SP1 server with IIS.

So far most of it seems to work apart from some minor 'bugs' wich

i've been able to work around (more on that in another post).

 

I'm having problems reaching the admin pages from remote computers.

On the local server i can open

http:///admin/index.asp

without problems. On other computers however this gives me a

HTTP 500 (internal server error), whereas other pages such as the reset or the update pages work OK.

I've checked (NTFS)permissions and the Directory security (set to integrated authentication) and its the same as the register and the update directories, wich is good i suppose.

 

What could be causing this?

[rvdmast]

About the minor bugs i mentioned:

I noticed that on the update page, once you filled everything in correct, the redirection to the next page (\register) didn't work.

In the .ASP pages you're using

Response.Redirect "/register"

however, it won't find the register.asp in that folder because by default

IIS sets the "Default document" to something like Default.html or index.html. Only after setting the correct default document on each folder to what it should be for your script, ie. register.asp for the register folder, index.asp for the reset and the update folder, etc...this started working.

 

Another solution i suppose, could be to modify the .asp code to use the full path. ie

Response.Redirect "/register/register.asp"

 

But since this is the first time i've bothered to look at .asp code i'd rather leave it alone for now.

[rvdmast]

I'm still having problems reaching the admin pages from remote computers.(everything else works fine)

i can open

http://localhost/admin/index.asp

just fine. But on other computers this gives me a

HTTP 500 (internal server error).

 

I've also tried other security/authentication settings (integrated, anonymous...) but all i get is error 500.

 

Any ideas, anyone? plexer?

[plexer]

rvdmast: good idea on that code I'll have a look.

 

I've got it installed but don't know if any kids have ever used it as I haven't had time to enforce it but I may do in the new year.

 

I was also thinking about having a kiosk machine permanently logged in as the reset pass user.

 

Irazmus is the one that can probably answer the coding issues as I had the original idea and he ran with it.

 

I'll have a look and see if I can replicate the problems.

 

Ben

[rvdmast]

Hi plexer,

Did you find time yet to try and replicate the problem?

Not that it's urgent, i can always work directly in the database with Access.

 

...I was also thinking about having a kiosk machine permanently logged in as the reset pass user...

 

I've taken a different aproach here: with the help of some free tools and a compiled autoit script i made i've been able to set up a kiosk machine where there are 2 extra buttons on the login screen (where it says press CTRL+ALT+DEL) which open a full screen browser (kiosk mode) to either the password reset page or our printer accounting page.

 

This way they can reset their password without having to log in.

[boomam]

Hi plexer,

Did you find time yet to try and replicate the problem?

Not that it's urgent, i can always work directly in the database with Access.

 

 

 

I've taken a different aproach here: with the help of some free tools and a compiled autoit script i made i've been able to set up a kiosk machine where there are 2 extra buttons on the login screen (where it says press CTRL+ALT+DEL) which open a full screen browser (kiosk mode) to either the password reset page or our printer accounting page.

 

This way they can reset their password without having to log in.

How have you done that?

 

Im looking at implementing 3 ways to change passwords.

1 of them is in place, with a custom MMC for staff.

The second will be this web app, and the third, would be like your proposing.

Giving pupils and staff 3 ways to do it without bothering me. .

[plexer]

rvdmast: I haven't yet but as soon as I have a spare 5 minutes I'll see what I can see.

 

booman: I think what rvdmast has done is rather than having a username for them to login to the reset system it accessible from the windows login instead.

 

So it's not another way of doing it just another way to access the reset system.

 

If that's correct rdv can you share how you've acheived that as it would be a great addition to the system.

 

Cheers,

 

Ben

[boomam]

Is there a more indepth install guide anywhere?

 

Im having problems getting this working, to any extent.

[plexer]

booman: I haven't forgotten just setting up a virtual domain to try it on.

 

Cheers,

 

Ben

[plexer]

Right I have just installed this on a virtual domain setup.

 

1 2003 SP2 domain controller and 1 XP Pro SP2 client.

 

I have noticed a few issues with the setup but once I'd tweaked that I was able to register my login and then use the system to reset the password.

 

The thing is that because when you next log in you have to change your password again anyway there's not a lot of point in the system enforcing a complex or even a long password on the user.

 

I'll post a new zip file up in a moment.

 

Ben