Chunks_ Posted May 3, 2012 Posted May 3, 2012 Hi All Sorry to bring up a old topic. But im having problems allowing teachers to change students passwords. I have 2 lots of software which is supposed to do this. However neither is working. When you type in the username it auto completes for you. Suggesting it has access to the OU of which i have delegated permissions. However when it goes to change the password one software says access denied the other says something about a except of a target of an invcation. Anyone have any suggestions. Im thinking some kind of group policy stopping it ? but dont know where to start. Cheers for any help.
Steve21 Posted May 3, 2012 Posted May 3, 2012 Hi All Sorry to bring up a old topic. But im having problems allowing teachers to change students passwords. I have 2 lots of software which is supposed to do this. However neither is working. When you type in the username it auto completes for you. Suggesting it has access to the OU of which i have delegated permissions. However when it goes to change the password one software says access denied the other says something about a except of a target of an invcation. Anyone have any suggestions. Im thinking some kind of group policy stopping it ? but dont know where to start. Cheers for any help. From what I've seen that error is generally if you're trying to use the wrong code to change passwords, or older methods, a lot of the methods require the old password to change the newpassword, (aka like windows change password), not AD side change password. Obvious other things to check, if you have a limit on password changes/days before changes/complexity etc. Could be a few things without seeing code/errors a bit more Steve
6Foot2 Posted May 3, 2012 Posted May 3, 2012 What software are you using that is giving you these problems? [What are the two packages?]
kmount Posted May 3, 2012 Posted May 3, 2012 Eliminate the software by trying it as an admin, and if that works you know you're looking at user/ad permissions as opposed to coding issues.
Chunks_ Posted May 3, 2012 Author Posted May 3, 2012 (edited) Thanks for your replies.... Yeah sorry should have added more information. If you use the software as an admin it works fine. The two peices of sofware are Burconix password changer and wisesofts password control. (both suggested on edugeek ) I have also put my computer and the test user into an OU and blocked inheritance to check for issues with gp .. still doesnt work so dont think its that now. Also there is no password policy except larger than 6chars so the one im entering would be fine. Edited May 3, 2012 by Chunks_
Steve21 Posted May 3, 2012 Posted May 3, 2012 I have also put my computer and the test user into an OU and blocked inheritance to check for issues with gp .. still doesnt work so dont think its that now. Also there is no password policy except larger than 6chars so the one im entering would be fine. You have to remember that LDAP allows most/all users to see people within the OU for items like outlook address book. In terms of editting it, maybe the permissions aren't working? Is it worth trying to give permissions to a random (non-viable through outlook etc) OU, and see if they can still autocomplete names in that OU. Steve
Chunks_ Posted May 3, 2012 Author Posted May 3, 2012 Not sure what you mean by non-viable. I dont have access to the email server as we are part of a wider group and that has been relocated to the head oriface!!!
Steve21 Posted May 3, 2012 Posted May 3, 2012 Not sure what you mean by non-viable. I dont have access to the email server as we are part of a wider group and that has been relocated to the head oriface!!! As an example, our student/teachers OUs are all searchable through outlook, for sending emails. However our service accounts aren't. "but" if you've given the teacher full OU access (for that one) they should be able to autocomplete names on that too. Just to ensure you're not overlapping "normal" permissions to view names, with "full control" for passwords. (You don't need access to outlook for this) If that made any sense? Steve
PiqueABoo Posted May 3, 2012 Posted May 3, 2012 Off-hand I think any domain account can validate whether another domain user exists unless default perms in AD have been modified. The AD permissions required to allow some group password changing (plus I hope simultaneous unlocking) are quite fiddly. I made my own code for this and it requires more than just standard Delegation i.e. I had to additionally set some specific perms for the password resetting group.
Chunks_ Posted May 3, 2012 Author Posted May 3, 2012 (edited) Ok Just to add some more info then. It auto completes users from directories that i haven't delegated access too. Which probably follows that this a bit of a red herring and maybe there is no access at all. I gave the test user full rights to that Organisation Unit and it still didnt work. Not sure if i said but i have also put the user and the computer into a ou that blocks all inherant policies. still not working. Edited May 3, 2012 by Chunks_
Chunks_ Posted May 3, 2012 Author Posted May 3, 2012 Ok so i have sorted but as part of it i need to set the interitance on the child objects (users) to inherit from the parent OU's (dont fancy ticking that box individually on 1500 users... anyone got a script i can use to do this? found one on the net but it was fully of errors...
PiqueABoo Posted May 3, 2012 Posted May 3, 2012 (edited) Very bestest advice: STOP until you completely understand why all those use objects don't have the inheritance tick. I don't have a script, but one reason for inheritance being blocked is the adminSDHolder stuff discussed in KB817433 which has a Microsoft script in Method 1 to fix that issue (I've used it in the past and it worked for me). There are clearer explanations of the adminSDHolder story in other places if you net-search. If you have a different cause then it's clearly possible to adapt that script to just reinstate inheritance on all users under a given OU or similar, but don't look at me because VBS just isn't my thing and I'd probably mangle the syntax and delete your AD. That said at a glance I think you just need to change the oCmd.CommandText query to point to the right OU, lose the adminCount condition, comment out the SetAdminCount line in the while loop, plus if you're a really tidy type remove the redundant bits and change what it tells you it's doing, but it's VBS so get an expert... Edited May 3, 2012 by PiqueABoo 1
Chunks_ Posted May 4, 2012 Author Posted May 4, 2012 Ok Thanks.... think i will use the adminSDholder to get the settings down to the user ... as per the KB article. Thanks
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now