Change Passwords without Domain Sign-in

There are many cases, though far from ideal usage, where a legitimate user is

not logged on to a Windows domain on your network, and still may need to change

his password. When he is logged on to the domain, he can simply press

Ctrl+ALT+DEL, select 'Change Password' button and do it. But if he is logged

on to his local system or another domain, changing the password becomes

difficult. One way around is to call up the administrator and get him to change

it. But this means that the new password is not a secret. The best way then is

to use IIS. Note that to continue with the steps described below, you need to be

on a Windows Server 2003 driven domain with IIS 6.0 installed.

Step 1: Enable scripts



In some cases, the scripts to use the functionality (changing passwords) may
have been installed to the server's hard disk, but not linked to IIS. To check

whether the scripts have been installed, open the IIS management console, the

Websites folder and then the Default website node there. If a virtual directory

site by name 'IISAdmPwd' exists, skip to step 3 below. Right click and

create a new Virtual Directory.



Provide the path as '%systemroot%\System32\ Inetsrv\Iisadmpwd' with 'Read'
and 'Run scripts' permissions. Now, we need to allow this script to change

passwords.

Open a Command Prompt window and change directory to your INETPUB folder and

the AdminScripts sub-folder. Run the following command.

adsutil.vbs set w3svc/1/PasswordChangeFlags 1

You can alternatively set it to '0' (instead of the '1' at the end of

the command above) to allow the operation only if it comes in on HTTPS (we're

enabling it for regular HTTP).

Step 2: Configure access



Now, we need to limit access to this path to only legitimate users of the
domain. This is simple. Go again to the IIS management console; navigate to the

virtual directory site you added in step 1 and select Properties from its

context menu. Go to the Directory Security tab and click on the Edit button

under 'Authentication' and check the option for 'Integrated Windows

Authentication'. Now, when a user hits the URL to change his password, he will

see a login box to authenticate himself before proceeding.

Once enabled, users can use a Web browser to navigate to the password change script and change passwords for their domain accounts

Step 3: Change password



To change password, user should visit http://mydomainserver/iisadmpwd/aexp2b.asp.
Now, the user can be logged on locally to his computer and still change his

password. Also, if he is mobile and this URL is accessible from the Net, then

also he can change his password.