Share via

Permissions required to reset password on ADCU

Daniel Blanca 1 Reputation point
2021-10-31T07:36:55.217+00:00

Hi,

I'm trying to grant a service account permissions to reset password for other user accounts but it's not working as expected. I've read many articles regarding this but didn't get the desired outcome. I got to the point where the service account is able to reset password for other users but they need to set a new one when they log on. On the reset password dialog the option "User must change password at next logon" is available and the service account can check/uncheck it but it doesn't count, the user has to set a new password no matter what. Under account options the service account is able to check this option but it can't uncheck it. What am I missing here? How can I accomplish this?

Thanks,
Daniel

Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
6,182 questions
0 comments

7 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Gary Reynolds 9,406 Reputation points
    2021-11-04T09:50:54.673+00:00

    Hi @Daniel Blanca

    Interesting, I can't think of any policy that would force the pwdlastset to be zeroed when the password is changed.

    The next step I would try to figure out what is causing this behaviour:

    1. Clear the User must change the password at logon check box
    2. Confirm the change has been saved by reopening the properties dialog.
    3. Confirm the value in the msDS-UserPasswordExpiryTimeComputed and if it's in the past
    4. Logon with the account to confirm that the current password is set
    5. Confirm the meta data of the user object and details of when and on which server the password was changed, you can use this page as a reference on how to get this information
    6. Use this page to get a before snapshot of the user object, enter the DN for the user for both left and right object and click compare
    7. Use ADUC to change the password
    8. In NetTools click on the compare again, to see what attributes have been changed
    9. Open the meta data dialog again and confirm, when and which server changed the value of the pwdlastset attribute, and is it different from the one that change the unicodepwd attribute

    Let us know how you go.

    Gary.

    0 comments
  2. Daniel Blanca 1 Reputation point
    2021-11-04T14:45:19.96+00:00

    Got it solved.
    I ran the Delegate control wizard on the root directory tree and I found some options there that you can't see when running this wizard on a specific OU.

    146583-image.png

    146509-image.png

    I checked these two and it did the trick, now I'm able to check and uncheck the "User must change password at next login" option under account options. And, of course, I can reset password without forcing the user to set a new one.
    Can't say for sure but I think it's the "Unexpire password" option which was needed, the other one can be skipped.

    Thanks for your help.