Re: "User must change password" doesn't happen immediately.

From: Kiu Kian Wun (kiu_at_protocom.com)
Date: 06/24/04

  • Next message: Frank: "Kerberos errors" 
    Date: 23 Jun 2004 18:27:48 -0700

    Hi Roger,

    Many thanks for your reply.

    I have confirmed that its due to the setting you mentioned. There's a
    link to MS website that explain this:

    http://msdn.microsoft.com/library/default.asp?url=/library/en-us/policy/policy/logon_optimization.asp

    Best regards,
    Kiu.

    "Roger Abell" <mvpNOSpam@asu.edu> wrote in message news:<#Mh6X6OWEHA.1380@TK2MSFTNGP09.phx.gbl>...
    > It sounds as if your client machine is XP in default state
    > relative to background login processing (async) or is W2k
    > that has been modified to allow async processing of login.
    > This is controlled by a policy. Check in the computer policy
    > tree, in the Admin templates / System / Group Policy where
    > you will find policies to allow async application of policy.
    > If this is allowed, login take place with the cached set of
    > policies, while in background any changes are obtained.
    > Hence, at second login the changes are available.
    >
    > --
    > Roger Abell
    > Microsoft MVP (Windows Server System: Security)
    > MCSE (W2k3,W2k,Nt4) MCDBA
    > "Kiu Kian Wun" <kiu@protocom.com> wrote in message
    > news:7ab1b75.0406212110.53e6dedf@posting.google.com...
    > > Hi,
    > >
    > > I have a server application that set user's password to expired so
    > > that user will be prompted to change password on the next logon.
    > >
    > > However, after the flag was set (verified in users account page) the
    > > user was not immediately prompted to change password when he logs on.
    > > He has to log off and back on again before seeing the password change
    > > dlg box. Its seems to me that the flag was only recognized/honoured on
    > > second logon attempt.
    > >
    > > Can someone please advise on how I can "force" password change to
    > > happen immediately and not on the second logon attempt? Or is this the
    > > normal behaviour?
    > >
    > > Much thanks,
    > > Kiu.

  • Next message: Frank: "Kerberos errors"

    Relevant Pages

    • Re: "User must change password" doesnt happen immediately.
      ... > that has been modified to allow async processing of login. ... > This is controlled by a policy. ... >> user was not immediately prompted to change password when he logs on. ... >> happen immediately and not on the second logon attempt? ...
      (microsoft.public.windows.server.security)
    • RE: Problem after setting password complexity
      ... change password after you enable "password must meet complexity ... I suggest you configure the password policy under "domain security ... Password must meet complexity requirements Enabled ... Microsoft CSS Online Newsgroup Support ...
      (microsoft.public.windows.server.sbs)
    • Re: Expiring inactive accounts
      ... domain security policy is set to Maximum password age for 60 days. ... In Windows NT 4.0 I used to enable the checkbox "User must login to ... did not change password in 60 days and came later he could not login. ... In Windows 2000 how do I achieve this? ...
      (Focus-Microsoft)
    • Re: What happened to the "Change Password" Button
      ... When we log into Outlook, we get a login box (not Windows login). ... but I'm looking for the change password button that was on the ...
      (microsoft.public.exchange.clients)
    • Re: Expiring inactive accounts
      ... domain security policy is set to Maximum password age for 60 days. ... In Windows NT 4.0 I used to enable the checkbox "User must login to ... did not change password in 60 days and came later he could not login. ... In Windows 2000 how do I achieve this? ...
      (Focus-Microsoft)