Device attached to system is not functioning when user change password

Question

1. Created a new user on the Domain controller with "User must change password at first login"
2. User is prompted to change password.
3. User logged to the workstation and received an error "A device attached to the system is not functioning".
4. User input new password directly to the AD server. Unchecked User must change password, and user can login to his workstation.

Answer 1

Hello!

Thank you for posting question on Microsoft Windows forum!

Based on the issue description, the issue arises from a **workstation-to-domain controller communication failure** during the password change process with the error message "**A device attached to the system is not functioning".** The error stems from **broken workstation-to-DC communication** during the password change process. By addressing DNS, firewall, time sync, and GPOs. You can try the following potential troubleshooting steps for resolving the issue.

1.Verify Domain Connectivity:

• From the workstation, try pinging the Domain Controller by name and IP address.
• Run ipconfig /all to verify DNS settings point to your Domain Controller(s).
• Run nltest /dsgetdc:yourdomainname to confirm the workstation can locate a Domain Controller.

2.Check Firewall Ports:

• Open required ports between workstations and domain controllers:
  • Kerberos: UDP 88
  • LDAP: TCP 389
  • SMB: TCP 445
  • RPC: TCP 135
• Test connectivity: Test-NetConnection DC_IP -Port 389 (PowerShell).

3.Check Workstation Event Logs:

• On the affected workstation, check the System and Security event logs in Event Viewer immediately after a failed login attempt with the "user must change password" setting. Look for errors or warnings that coincide with the time of the failed login.
• Pay attention to events related to Winlogon, Credential Providers, network connectivity, and Kerberos.

4.Test with Another Workstation:

• If possible, try setting up another test user with "User must change password at first login" and have them attempt to log in to a different workstation. This helps determine if the issue is specific to the original workstation or a more widespread problem.

5.Group Policy Review:

• Check GPOs affecting password policies or user rights:
  • Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment.
  • Ensure "Allow log on locally" includes domain users.
  • Verify no policies block password changes.

6.Try a Different User Account (with "must change password"):

• Create another new user with the "User must change password at first login" flag and try logging in from the same problematic workstation. This helps confirm if it's user-specific or workstation-specific.

Hope the above information is helpful!