Windows 2019 RDP user cannot change expired password

Question

Hello

I have a issue on my domain users that needs to change expired password. I have NLA enabled and this is still not possible.
When they are connecting first time or they have already passed time to change password before it will expire pop up with Remote Desktop Connection windows appears with You must change password without option to do it.
My domain is 2019 functional lvl and users are connecting starting from Win2008 and Windows 7 clients. Is it possible to make it possible to change password via some GPO setting ? .
Any advice are welcomed.

Answer 1

Hello @T3hboy

Is it possible to make it possible to change password via some GPO setting ?

In case of users' password expiration, as I know no such group policy can help change it.

This article Domain Password Policy in the Active Directory explains in detail password policy in AD.

You will need to manually editing an RDP file to disable CredSSP (not recommended) to fix this temporarily. see Forced password change at next logon and RDP

Essentially you are better off enabling the GPO to "warn users in X number of days" when their password is about to expire and ensure they manually change it after they have authenticated to the server with the valid password.

Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.

Best regards
Karlie

Answer 2

Hello,

Selecting that "User must change password at next logon" and then their first login attempt on the domain is a RDP login will cause that error. That setting forces them to change their password when they log in for the first time, it isn't what allows them to change the password. When attempting to remotely authenticate, it will error because they haven't logged directly into the domain yet.

To resolve this issue you can either provide temporary passwords to the users to long in and change for a private one, or you have to edit the Session Collection, Security, Configure Security settings and then change the Security Layer setting from Auto-Negotiate to RDP Security Layer. Once that change has been applied, remote RDP users return to being able to set a new password.

As an added bonus, this RDP Security Layer is actually more secure, and is also PCI Compliant

------------------------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept as answer--