This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(198.4, 94%, 29%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EHW%3C/text%3E%3C/svg%3E)
After CU14 update install on exchange 2019, users can not change the expired passwords, Change password screen appears where you put the current and new passwords and then "something went wrong" appears. Please help
A robust email, calendaring, and collaboration platform developed by Microsoft, designed for enterprise-level communication and data management.Miscellaneous topics that do not fit into specific categories.
The administration and maintenance of Microsoft Exchange Server to ensure secure, reliable, and efficient email and collaboration services across an organization.
The administration of a hybrid deployment that connects on-premises Exchange Server with Exchange Online, enabling seamless integration and centralized control.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(284.8, 17%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EYS%3C/text%3E%3C/svg%3E)
Hi @Hassan Waheed and @Jaroslav Mixa ,
Just wondering are you in a multi-forest topology? If so, please go through the article below and make sure the setting override mentioned there has been configured.
Users in account forest can’t change expired password in OWA in multi-forest Exchange deployments after installing August 2023 SU
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(144, 68%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJM%3C/text%3E%3C/svg%3E)
We have the same issue.
We have a hybrid environment and some users cannot log in or change passwords using OWA. The login window appears again and again.
It seems it happens mainly to external users outside of the domain.
We cleared the browser cache, saved passwords, and tried an incognito window. We tested Chrome and Firefox.
It started after the last exchange upgrade.
Hi @Hassan Waheed ,
Please run the Exchange PowerShell below to check if there's an OWA mailbox policy applied to the affected user:
Get-CasMailbox <UserIdentity> | fl owamailboxpolicy
If the result shows there's no OWA mailbox policy applied, go to EAC > Servers > Virtual Directories > Features, make sure the checkbox of "Change password" is selected:
In case the above has already been checked but the issue remains, please go EAC > Permissions > Outlook Web App policies, select the policy you want to use, click features, make sure the checkbox of the "Change password" is selected:
Apply the owa mailbox policy to the affected user:
Set-CASMailbox -Identity <UserIdentity> -OwaMailboxPolicy <MailboxPolicyIdParameter>
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Thanks Yuri for your help.
I have checked this already, all the permissions are set,
Still getting the same issue.
Hi @Hassan Waheed ,
Have you had a chance to try creating a new OWA mailbox policy with the necessary features and then assign it to one affected user to see how it goes?
By the way, how about resetting the password on a domain joined machine by hitting "Ctrl+Alt+Delete"?
Well Yuri, the issue is for all the users, not just 1 or 2.
secondly, We are running multiple domains, so machines are on different domains.
Plus, when i reset the password from AD, and check "change password on the nest logon" then there is an issue with the password reset. when i check the "password never expire" then there is no issue.
this is just for the expired password.
if my password is not expired and i change the password from OWA, it works fine too.
Hi @Hassan Waheed ,
Thanks for the clarification.
if my password is not expired and i change the password from OWA, it works fine too.
I do understand that the issue appears right after installing CU14, but from these symptoms, this doesn't seem to be an issue concerning the "Change Password" permission in either the OWA virtual directory or the OWA mailbox policy, otherwise the users would be unable to change password in any situations.
And considering that you also have issue when checking "change password on the nest logon" in AD, it appears to me that it's more likely to be an issue related to AD. As aforementioned, can the affected user change expired password when logging on domain-joined machine? If it fails either, I'd recommend checking the password policies in AD and see if there are any findings.
Hi @Hassan Waheed ,
Just checking in to see how things are going on with this issue. Is there anything you'd like to update? By the way, if you are in the RDP environment, you might be interested to check thread below which discusses an issue occurred in RDP environment that users cannot change expired password: https://learn.microsoft.com/en-us/answers/questions/1013756/windows-2019-rdp-user-cannot-change-expired-passwo
In case you still need further assistance in terms of the password policies in AD, I'd recommend trying to start a new thread using some Windows Server or Active Directory tags so that community users who are more familiar with AD could be able to look into the issue as well.
So here is the update, I have put all my user's passwords to "Never Expire". and I have tested using a laptop in the domain, and tried to reset the expired password by Dell+Alt+Ctrl, and guess what, I was able to change the password, I tried resetting the expired password on OWA, same issue, no luck.
This is very interesting.
Hi @Hassan Waheed ,
Thanks for the update. It's indeed weird. Just wondering was there any other change aside from installing Exchange CU14 occurred right before the issue? And are your users using RDP?
Just CU14, I only RDP into servers, users connect via outlook or OWA.
Hi @Hassan Waheed ,
Sorry that I am not a Windows server expert and my knowledge about RDP is limited. But based on my research, have you tried checking the Security Layer setting and see if it's configured as "RDP Security Layer"? If not yet, I assume it's worth trying to change this setting and see if there would be any difference.
Windows Server 2016 RDP–You must change your password before logging on the first time
Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(156.8, 36%, 25%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EC%3C/text%3E%3C/svg%3E)
I have the same problem (E2K19, CU14, Single domain). Did you find the way to resolve ?