Background:
Ther server is Windows 2003 with SP1 included. We have a 3rd party
cert for SSL and require SSL for the URL and WWW meta Changepassword setting
is 0. We wanted only certain users to be able to change their passwords via
the web page and made a domain group called Web_Passord. I removed "Users"
from IISADMPWD folder and added the ASP account and Web_Passord domain group
with the same ACLs.
Everything worked fine. I could create a new user, add them to the
web_password group, set a temp pwd, set change at next logon, and the user
could to just that.
Now, If change at next logon is set, you get into a loop for logon with name
and password.
What changed? - We have a minimum pwd age of 1 day. Some users got
frustrated when they changed thier pwd, change thier mind, and wanted to make
it something else (in the same day). The response was not specific enough
"Your password does not meet these requirements...." So I copied all the ASP
files to a safe place and added logic for "if int(Now - password last
changed) = 0 then write.response 'Your password must be older than 24 hours.'
end if" and that worked great. Execpt for now If I force pwd change you just
get prompted over and over to logon.
I even put back all the original ASP files. Tried the old habit of
reapplying SP1. I have the Hotfix KB833734 but that won't install since the
OS has SP1. I double checked the rest of the settings described in
http://support.microsoft.com/default.aspx?scid=kb;en-us;833734
I don't understand all the Technet articles and posts on the web state the
2K3sp1 fixed this.
Any help is greatly appreciated.