Change password functionality replaced with Active Server Pages

Article translations Article translations
Article ID: 331834 - View products that this article applies to.
This article was previously published under Q331834
We strongly recommend that all users upgrade to Microsoft Internet Information Services (IIS) version 7.0 running on Microsoft Windows Server 2008. IIS 7.0 significantly increases Web infrastructure security. For more information about IIS security-related topics, visit the following Microsoft Web site:
http://www.microsoft.com/technet/security/prodtech/IIS.mspx
For more information about IIS 7.0, visit the following Microsoft Web site:
http://www.iis.net/default.aspx?tabid=1
Expand all | Collapse all

SUMMARY

With Internet Information Server (IIS) 4.0 and Internet Information Services (IIS) 5.0, the change password functionality is handled through an ISAPI extension, Ism.dll. This component has been removed from IIS versions 5.1 and 6.0, and the change password functionality has been modified to use Active Server Pages (ASP).

MORE INFORMATION

Note Users who are running IIS 5.0 together with Microsoft Windows 2000 Service Pack 4 (SP4) should follow the steps in Microsoft Knowledge Base article 831047. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
831047 FIX: You experience various problems when you use the Password Change pages in IIS 5.0
Users who are running IIS 6.0 together with Microsoft Windows Server 2003 Service Pack 2 (SP2) should follow the steps in Microsoft Knowledge Base article 833734. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
833734 FIX: You experience various problems when you use the Password Change pages in IIS 6.0
Using the Ism.dll ISAPI extension potentially exposes the Web server to more of a security risk because Ism.dll must be run under the security context of System. ASP, however, is run under the configurable security context of the current process (such as DLLHost, which uses the user, IWAM_<MachineName>, by default).

Using ASP technology also provides additional benefits, such as the ability to customize the change password functionality pages to include graphics or Web site designs.

This feature is available in the latest service pack for Windows 2000. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
260910 How to obtain the latest Windows 2000 service pack
A downloadable package has been created to deliver this ASP functionality for servers that are running IIS 5.0 on Microsoft Windows 2000 Server Service Pack 3 (SP3) or IIS 4.0 on Microsoft Windows NT 4.0 Server Service Pack 6a (SP6a).

Note This package has been tested and approved for use with Microsoft Exchange versions 5.5 and 2000 running Outlook Web Access (OWA). Because OWA references these files with an .htr extension, manually renaming the files breaks the OWA use of the change password functionality.

Windows 2000

To obtain and install this package, follow these steps:
  1. Make sure that the Iisadmpwd virtual directory is present. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    269082 IISADMPWD virtual directory is not created during clean install of IIS 5.0
  2. To download the installation package for Windows 2000 Service Pack 2 or Windows 2000 Service Pack 3, visit the following Microsoft Web site:
    http://www.microsoft.com/downloads/details.aspx?FamilyID=f2626ac2-36c7-43a5-a2b7-c01fdcf220e4&displaylang=en
  3. After you install the tool that converts the .htr pages to use ASP technology, update the .htr pages by using the hotfix packages that are described in the following article in the Microsoft Knowledge Base:
    831047 FIX: You experience various problems when you use the Password Change pages in IIS 5.0
  4. In the Iisadmpwd folder, rename the Text.asp file as Text.htr.
  5. In Notepad, open the Anot.htr file and the Anot3.htr file. Locate the following line of code.
     <!--#include file = "text.asp"--> 
  6. In both files, change the line of code that you located in step 5 to the following line of code.
     <!--#include file = "text.htr"--> 
  7. To configure these pages appropriately, follow the instructions that are described in the Microsoft Knowledge Base article in step 3.

To download the ADSI client for Windows NT 4.0, visit the following Microsoft Web site:
http://technet.microsoft.com/en-us/library/cc750223.aspx
Additional details

The following table outlines the current implementations by IIS versions before you install this package:

Collapse this tableExpand this table
IIS VersionFile ExtensionISAPI Extension Used
4.0.htrIsm.dll
5.0 (pre-SP4).htrIsm.dll
5.0 (SP4).htrAsp.dll
5.1.aspAsp.dll
6.0.aspAsp.dll

The installation of this download, Ism2asp.exe, changes any use of Ism.dll in the table to Asp.dll. The file name extension, .htr, remains the same although the page itself is written with ASP technology and Microsoft Visual Basic Scripting Edition (VBScript).

REFERENCES

For more information about how to create the Iisadmpwd virtual directory, click the following article number to view the article in the Microsoft Knowledge Base:
269082 IISADMPWD virtual directory is not created during clean install of IIS 5.0
315579 "HTTP error 403" error message when password changed with OWA or Iisadmpwd
260838 MS00-031: IIS stops servicing HTR requests
For more information about the updated Password Change pages in IIS 5.0 and IIS 6.0, click the following article numbers to view the articles in the Microsoft Knowledge Base:
831047 FIX: You experience various problems when you use the Password Change pages in IIS 5.0
833734 FIX: You experience various problems when you use the Password Change pages in IIS 6.0

Properties

Article ID: 331834 - Last Review: July 3, 2008 - Revision: 18.2
APPLIES TO
  • Microsoft Internet Information Services 5.0
  • Microsoft Internet Information Server 4.0
Keywords: 
kbwin2ksp4fix kbinfo KB331834

Give Feedback

 

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com