Remote Desktop users unable to change password upon first login or after expiry

Question

I have (2) 2019 Servers. They are both domain controllers and remote desktop servers.

When I setup a new user account on server 1, the user can login and it prompts them to change their password. It works fine.

On server 2 it gives them an error message "You must change your password before logging on for the first time" It does not log them in nor allow them to change their password.

I have a group policy that has disabled Require user authentications by using network level authentication.

Answer 1

Hello,

The issue you're facing with the user accounts on Server 2, where users are unable to log in and change their password, may be related to the Group Policy setting that disables "Require user authentication by using network level authentication." Here are a few steps you can take to troubleshoot and resolve the problem:

Verify Group Policy settings: Double-check the Group Policy setting that disables network level authentication. Ensure that the policy is applied correctly to Server 2 and that there are no conflicting policies that might override or modify this setting.

Test with network level authentication enabled: Temporarily enable the "Require user authentication by using network level authentication" policy setting on Server 2 and verify if users can log in and change their password successfully. This step will help determine if the issue is specifically related to the network level authentication setting.

Check user account properties: Review the user account properties on Server 2 to ensure that there are no account-specific settings preventing the password change. Make sure the "User cannot change password" and "Password never expires" options are not enabled for the affected user accounts.

Confirm connectivity and domain replication: Ensure that Server 2 has proper connectivity to the domain controller responsible for handling the user account changes. Check for any network or replication issues that might be impacting the synchronization of user account information between the domain controllers.

Review event logs: Examine the event logs on Server 2 for any relevant error or warning messages that might provide insights into the login and password change failure. Look for events related to user authentication, password policies, or Active Directory replication.

Test account creation on a different server: Try creating a test user account on another server or domain controller and verify if the issue persists. This step will help determine if the problem is specific to Server 2 or if it affects user accounts created on other servers as well.

Consider firewall or security software settings: Review the firewall or security software settings on Server 2 to ensure they are not interfering with the password change process. Temporarily disabling any security-related software or adjusting firewall rules can help identify if they are contributing to the problem.

Verify time synchronization: Check the time synchronization between Server 2 and the domain controller(s). Time discrepancies can cause authentication issues and affect password changes. Ensure that both Server 2 and the domain controller(s) are synchronizing time accurately.

If the issue persists after following these steps, it may be helpful to involve your organization's IT department or engage the support channels provided by Microsoft for further assistance in troubleshooting and resolving the specific problem you're encountering.

I used AI provided by ChatGPT to formulate part of this response. I have verified that the information is accurate before sharing it with you.

--If the reply is helpful, please Upvote and Accept as answer--