FIX: You experience various problems when you use the Password Change pages in IIS 5.0

• The first letter of the account name for the user is truncated.
• You cannot change passwords for users whose passwords must be changed at the next logon.
• You cannot change passwords for users whose passwords have expired.
• You cannot change passwords across forests.
• You cannot use user names in an UPN format.

Back to the top

Hotfix information

Prerequisites

Restart requirement

Hotfix replacement information

File information

   Date         Time   Version            Size    File name
   --------------------------------------------------------------
   05-Oct-2004  08:40                      5,735  Achg.htr
   05-Oct-2004  08:40                      2,382  Aexp.htr
   05-Oct-2004  08:40                      2,227  Aexp2.htr
   05-Oct-2004  08:40                      2,829  Aexp2b.htr
   05-Oct-2004  08:40                      1,974  Aexp3.htr
   05-Oct-2004  08:40                      2,218  Aexp4.htr
   05-Oct-2004  08:40                      2,837  Aexp4b.htr
   05-Oct-2004  08:40  5.0.2195.6982      31,504  Iispwchg.dll     
   05-Oct-2004  08:40                      2,385  Text.htr

Back to the top

1. Register the Iispwchg.dll file in the Iisadmpwd directory. To do this, click Start, click Run, type regsvr32 c:\winnt\system32\inetsrv\iisadmpwd\iispwchg.dll, and then click OK.
2. Configure the PasswordChangeFlags property in the metabase to make sure that the Password Change functionality is enabled. To do this, follow these steps:
   1. Click Start, click Run, type cmd, and then click OK.
   2. Locate the C:\Inetpub\Adminscripts directory.
   3. Type the following command, and then press ENTER:
      cscript.exe adsutil.vbs set w3svc/passwordchangeflags Value
      Note In this sample command, Value is a placeholder for the value that you want to set for the PasswordChangeFlags property.
   The following list includes the possible values for the PasswordChangeFlags property. You can use a combination of these values.
   • 0
     
     This value is the default value. This value indicates that you must use a Secure Sockets Layer (SSL) connection when you change the password.
   • 1
     
     This value permits password changes on non-secure ports. This value is useful if SSL is not enabled.
   • 2
     
     This value disables the Password Change functionality.
   • 4
     
     This value disables the advance notification of password expiration.
3. Make sure that the virtual directory for the Iisadmpwd directory is correctly created and that the virtual directory points to the correct location. The correct location is System32\Inetsrv\Iisadmpwd. There is no requirement to have Anonymous Authentication enabled on the virtual directory. We recommend that you use the same authentication on this virtual directory as that of the application that redirects users to the virtual directory.   (http://support.microsoft.com/kb/269082/US-EN/ )
4. Make sure that the .htr files are mapped to the Asp.dll file in the "AppMappings" section for the Iisadmpwd directory. To do this, follow these steps:
   1. In IIS Manager Microsoft Management Console (MMC), right-click the iisadmpwd directory, and then click Properties.
   2. Click the Virtual Directory tab.
   3. On the Virtual Directory tab, click Configuration.
   4. In the AppMappings section, look for a line that has .htr. That line is listed in the Extension field. Verify that the executable file that is listed to the right points to the Asp.dll file. If the link that has .htr that is listed in the Extension field does not exist, you must add it. If you must add this extension, click Add. If you must edit this extension, select the extension, and then click Edit.
   5. For the executable file, click Browse, and then locate the Asp.dll file in the System32\Inetsrv directory.
   6. In the Extension field, type .htr.
   7. Set the Limit verbs to GET,POST.
   8. Click OK to save the changes, and then close all Properties windows.
5. Verify that the following metabase entries are correctly set:
   Collapse this tableExpand this table

   Metabase entry and value	Description
   Metabase entry: AuthChangeUrl Metabase value: iisadmpwd/achg.htr	This page does the actual password change work.
   Metabase entry: AuthExpiredUrl Metabase value: iisadmpwd/aexp.htr	This page displays the password change form for a user whose password has expired. SSL must be enabled for this page to work. Make sure that you type the account name in the "domain\username" format.
   Metabase entry: AuthExpiredUnsecureUrl Metabase value: iisadmpwd/aexp3.htr	This page displays the password change form when SSL is not enabled or is not used.
   Metabase entry: NotifyPwdExpUrl Metabase value: iisadmpwd/anot.htr	If the Password Expiration Notification functionality is enabled, this page is displayed when SSL is enabled.
   Metabase entry: NotifyPwdExpUnsecureUrl Metabase value: iisadmpwd/anot3.htr	If the Password Expiration Notification functionality is enabled, this page is displayed when SSL is not enabled or when SSL is not used.
   Metabase entry: PasswordExpirePreNotifyDays	This metabase entry specifies the number of days that remain before the password of the client expires. This metabase entry also indicates when a password pre-notification message is sent.

6. By default, the metabase entries that are related to the pages that are previously described are located at the W3SVC level in the registry and do not have to be modified. However, if the metabase entries have to be changed or have to be verified, the application Mdutil.exe can be used as follows. The application Mdutil.exe is available on the Windows 2000 Support CD.
   1. Copy Mdutil.exe to the server that is running IIS.
   2. Open a CMD window.
   3. Locate the folder that contains Mdutil.exe.
   4. To verify the current value in the metabase, you can use the following:
      
      Mdutil.exe get w3svc/MetabaseKey.
      
      For example, type the following:
      
      Mdutil.exe get w3svc/AuthChangeUrl
   5. To change the value, you can use the command just as you previously did. However, replace "get" with "set." Also, specify the value at the end.
   If you have to change either PasswordChangeFlags or PasswordExpirePreNotifyDays, you have to use the Adsutil.vbs script to configure these metabase entries. The Adsutil.vbs script is located in the Inetpub\Adminscripts directory on your system. To use the Adsutil.vbs script to configure these metabase entries, follow these steps:
   1. Open a CMD window.
   2. Locate the C:\Inetpub\Adminscripts folder.
   3. To set the values, you can use the following:
      
      Cscript.exe adsutil.vbs set w3svc/MetabaseKey
      
      For example, type the following:
      
      Cscript.exe adsutil.vbs set w3svc/PasswordChangeFlags 1
   4. To examine the values, you can use the same command as you previously used. However, replace "set" with "get." Do not appended the value at the end.

Back to the top