rvdmast

Ok so i got SSPR 2.2.1 to work again, however i noticed i still have the problem described earlier in this thread: Whenever i wan't to load the admin pages from any computer other then the server i get: Microsoft VBScript runtime error '800a0046' Permission denied: 'GetObject' /admin/auth.asp, line 33 which reads: Set UserObj = GetObject("WinNT://" & FQDN & "/" & CurrentUser & ",user") Maybe this requires impersonation too? Btw i'm still running it on a member server, not a DC.

I just updated to SSPR 2.2.1 and , when resetting, now i'm getting this error too: Wachtwoord resetten voor XXX ... An unexpected error occurred in the execution of this page Please report the following information to an Administrator Page Error Object Error Number: -2147024891 Error Description: General access denied error Source: Active Directory LineNumber: 0 However our SSPR_SERVER (which in our case is called PwReset) is member of domain admins. So it can hardly be a matter of rights, can it? [edit: In fact, even using Administrator doesn't work] i read that boomam had the same problem but i couldn't find a solution. Does the server have to be restarted after registring LoginAdmin.dll? Does the username in cred.ini need DOMAIN\ before it ( or @FQDN after it)? [edit: Never mind after changing the username/password back again it miraculously seems to work now...Thanks for your time]

Some GPO settings will remain if you set (enable) them first, then set them to not defined. You'll have to set it to disabled.

Now that there's a new version of SSPR I've been thinking about a few things: 1 - I spent half a day translating all the texts in the ASP files to Dutch. When i install a new version I'd have to do that all over again. And something tells me this isn't the last version to come out I'm no expert at ASP (yet, though i did read up & practice a bit) but would it be possible to use a language file like language.asp that you would #include which contains these texts for a specific language? I'm thinking this file could be just a bunch of string variables with the appropriate texts. Then in the .asp files you'd replace the texts that are currently there with the appropriate variable from language.asp... So, if you want English texts you'd download & use the English language.asp, German user would use the German language.asp etc... These could of course be created and submitted here by users themselves. 2 - How difficult would it be to create an installer? I've seen other installers set up websites in IIS and configure them as required. And if i remember correctly one can import/export IIS settings. And something tells me one could probably do a lot with vbscript or something...

Right now, we use this only on one dedicated workstation in our library. Mostly because we were still testing this, and, as you can see in my how-to it still requires some manual tweaking on each workstation. Plus, we've published the SSPR on our ISA servers so they can also reset their password from home. So one dedicated workstation is really enough.

As promised, here's how to create a “reset password” button on the login desktop, so that users whom forgot their password, and therefore cannot log in, are still able to acces the password-reset website. For the actual password resetting we use the “Self Service Password Reset” free software by Ben "Plexer" Norcutt and Alex "Irazmus" Kitching wich can be found here: http://edugeek.net/forums/showthread.php?t=2022&page=8 this article only shows how to create a “reset password” button on the login desktop wich opens your password reset page once you set up “Self Service Password Reset”. The most difficult part is getting something to show on the login desktop. Windows uses the concept of Windowstations and Desktops. The screen you see before anyone has logged in to the computer, called WinSta0\WinLogon, is a different desktop in a different Windowstation then the desktop you see after someone has logged in, called WinSta0\Default . These Desktops/Windowstations are completely separated and programs running in one desktop cannot access programs on another desktop. Also, to run anything on the login desktop you need certain privileges (rights) which normaly only the SYSTEM account has. Fortunately there is the utility RunProcess.exe by Frank P. Westlake which among many other cool things allows you to start a process on any windowstation/desktop if you have the appropriate privileges. You can download it here: http://www.jsifaq.com/SF/Tips/Tip.aspx?id=7127 Next, we need to create a windows service to run our program. Why? Firstly because we need the appropriate privileges and a service running under the system account has these. Secondly we want our program to start without anyone having to login. This is what services are for. Since, like most programs that require user interaction, the actual program which will present the reset button does not support running as a service, we will create a “wrapper service” which will load our program. This is NSSM: The Non-Sucking Service Manager http://iain.cx/src/nssm/ Finally there’s the actual program which does nothing more than show a button which opens your password reset page in Internet explorer. It’s a simple compiled AutoIt script, source code included. There are some security issues you should be aware of. This system runs Internet explorer under the SYSTEM account which has full administrative access to anything on your computer! Should a user be able to browse to a malicious site in this browser then the results might be disastrous. We need to limit what a user can do and where he can surf on the computer where this system runs. First we will use Internet explorer’s content rating system to make your password reset website the only website users are allowed to visit. They cannot visit any other websites unless they know the Parental control password. (Default is “w3lk0m”). This is done by copying a ratings file (lockdown.rat) to the system directory and importing some registry entry’s from the file “pwreset.reg” IMPORTANT: you must first edit the file pwreset.reg with notepad and replace any instance of “yourdomain.com” with the URL/domain of your choice Secondly we need to disable all unwanted toolbars, buttons etc. in Internet explorer. You could use Group Policy to do this, or you could manually double click the file ie-restrictions.reg which is just a sample of what you could do. The installer does not do this, it’s your choice. Finally, as said above, this system runs Internet explorer under the SYSTEM account which has full administrative access. But we can take away these rights for just the Internet explorer without restricting the SYSTEM account (which would probably break your computer) by using Software restriction policy’s. To do this, enable SAFER technology by creating the following registry key: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers] Key: "Levels" (REG_DWORD) Value: 00031000 Or just double click “safer.reg” Then open the (local) Group Policy editor by typing “gpedit.msc” in Start/Run. Under “Computer configuration” go to Windows settings/Security Settings/Software Restriction Policies/Security Levels. You should see 5 trust levels: Disallowed, Untrusted, Restricted, Basic user and Unrestricted. Now go to Windows settings/Security Settings/Software Restriction Policies/Additional Rules, Right-click and create a new “Path Rule”, Enter the path to iexplore.exe for ie. “C:\Program Files\Internet Explorer\iexplore.exe” And set the security level to Basic user, or Resticted if you want guest-level acces for IE. Now IE will ALWAYS run with limited rights, regardless which user executes it (even Administrator or SYSTEM) To make setting all this up easier I have created install.cmd which does most of the work to install this. Only the restricting of IE’s user interface and the creation of a software restriction policy has to be done manually. pwreset.zip

@ BOOMAM, Like plexer said, my setup allows pupils to access the reset-pages from the windows login screen without having to login first. It display's an extra button below the "press CTRL-ALT-DEL..." dialog that opens the reset pages in a tightly restricted full screen browser. Right now i am a little short of time, but i've already promised plexer i'll post a description how i achieved this in this thread, later this week or next week. So sit tight...

First thing to try is to type shutdown -a in start-run, this will (hopefully) abort the pending shutdown and give you time to troubleshooot. It might buy time to complete a full virusscan. next thing to try is typing this in start-run: SFC /SCANNOW this will check the integrity of your windows files & put them back from the original CD if needed.

Hi plexer, Did you find time yet to try and replicate the problem? Not that it's urgent, i can always work directly in the database with Access. I've taken a different aproach here: with the help of some free tools and a compiled autoit script i made i've been able to set up a kiosk machine where there are 2 extra buttons on the login screen (where it says press CTRL+ALT+DEL) which open a full screen browser (kiosk mode) to either the password reset page or our printer accounting page. This way they can reset their password without having to log in.

I'm still having problems reaching the admin pages from remote computers.(everything else works fine) i can open http://localhost/admin/index.asp just fine. But on other computers this gives me a HTTP 500 (internal server error). I've also tried other security/authentication settings (integrated, anonymous...) but all i get is error 500. Any ideas, anyone? plexer?

About the minor bugs i mentioned: I noticed that on the update page, once you filled everything in correct, the redirection to the next page (\register) didn't work. In the .ASP pages you're using Response.Redirect "/register" however, it won't find the register.asp in that folder because by default IIS sets the "Default document" to something like Default.html or index.html. Only after setting the correct default document on each folder to what it should be for your script, ie. register.asp for the register folder, index.asp for the reset and the update folder, etc...this started working. Another solution i suppose, could be to modify the .asp code to use the full path. ie Response.Redirect "/register/register.asp" But since this is the first time i've bothered to look at .asp code i'd rather leave it alone for now.

I've been setting this up today on a fresh 2003 SP1 server with IIS. So far most of it seems to work apart from some minor 'bugs' wich i've been able to work around (more on that in another post). I'm having problems reaching the admin pages from remote computers. On the local server i can open http:///admin/index.asp without problems. On other computers however this gives me a HTTP 500 (internal server error), whereas other pages such as the reset or the update pages work OK. I've checked (NTFS)permissions and the Directory security (set to integrated authentication) and its the same as the register and the update directories, wich is good i suppose. What could be causing this?

in IIS manager, under Web Service Extensions, enable active server pages.

Found this on jsifaq.com : http://www.jsifaq.com/SF/Tips/Tip.aspx?id=5620 5620 » How do I prevent double-clicking the Start menu Programs item from opening Window Explorer? 15-Aug-02 You locked down your users, only to find that they can double-click the Programs item on the Start menu and open Windows Explorer. To prevent this behavior: 1. Copy / Paste the following into a NoWE.reg file: REGEDIT4 [HKEY_CURRENT_USER\Software\Classes\Folder\shell\open] "BrowserFlags"=dword:00000010 "ExplorerFlags"=dword:00000012 [HKEY_CURRENT_USER\Software\Classes\Folder\shell\open\command] @=hex(2):00,00 [HKEY_CURRENT_USER\Software\Classes\Folder\shell\open\ddeexec] @="[ViewFolder(\"%l\", %I, %S)]" "NoActivateHandler"="" [HKEY_CURRENT_USER\Software\Classes\Folder\shell\open\ddeexec\application] @="" [HKEY_CURRENT_USER\Software\Classes\Folder\shell\open\ddeexec\ifexec] @="[]" [HKEY_CURRENT_USER\Software\Classes\Folder\shell\open\ddeexec\topic] @="AppProperties" 2. Merge the NoWE.reg file with each of your users registries.