Users are required to change their password...but only takes effect at second logon?

[link470]

Original Title: Users are required to change their password...but only takes effect at second logon?

 

Hello! Hope everyone's been having a good summer. I'm back at the district now and I thought well, since the policies at the school here haven't been enforcing password policies at all, I'm at least going to go through all the staff in Active Directory and click "User must change password at next logon" and make them have a password at least 7 characters long. No problem.

 

Oh wait...

 

I start getting a few staff members who have come in early [only 4 so far luckily but all with identical issues] who have come up to me and said when they login they don't have access to any network drives, network services, or anything that they need to be authenticated for. When I ask each of them if they received a dialog box asking them to change their password, they all said they didn't. However, if they log off, and log back on, the box appears instantly, and they change their password, login, and they're good to go. No problems. But why is there that delay? I understand cached logins, but why the second time and not the first? I don't want people to be panicking or to put out a notice to log on, log off, and log on again the first time they log in.

 

Any help would be greatly appreciated on how I can easily resolve that issue.

 

Thanks so much!

Edited August 28, 2009 by link470

[DrPerceptron]

Is the network etc fully up at that point on that PC?

 

I know as I've been cruising around, GPO's haven't been applying because 4 year old Dell Optiplex's can't keep the frigging time... I was suitably impressed to be taken back to August 1604 by one though...

 

Whether that impacts it I'm not sure.

 

Edit: User Password Prompt - Active Directory

 

That topic may be of some use to you.

Edited August 26, 2009 by DrPerceptron

[DMcCoy]

Roaming profiles? Could be When you try to log on to a Windows XP SP3-based computer by using a roaming profile, the roaming profile cannot load.

[link470]

Edit: User Password Prompt - Active Directory

 

That topic may be of some use to you.

 

Ah, makes sense. I'll give that a shot, thanks!

[strawberry]

cached logons mate.

 

Cached domain logon information

[link470]

Excellent thanks guys, that confirms what I thought it was. I enabled the wait for the network GPO, and staff were still having problems, and that's when I realized wait, that GPO will be applied at the same time the new password policy was so I'm starting up some systems, leaving them on for a couple minutes, and turning them off again until staff come in haha! So far they're working!

 

Thanks again.