VPN and password changes

[MTVW]

Any idea why I cannot change passwords via VPN from the ctrl-alt-delete screen?

 

[compuveg]

Are you authenticating the VPN session using kerberos?

Assuming you are, I would have expected that to work. I can only theorize that the VPN session is partly encrypted using the password as one of they keys, and you aren't being allowed to change that mid-stream. I will keep the thread emailing me though, as I'm in a similar situation and am eager to hear the opinion of someone more knowledgeable than myself.

My one suggestion is to make sure that in the list of systems which the password is being changed for, I would make sure the VPN client isn't included in that.

 

[MTVW]

We use group authentication for VPN with 2 different group ids..one for users and one for admins with no restrictions.
Neither of them work. Connect remotely via vpn...then select ctrl-alt-del and change password....no go.

 

[skialta]

You can't change passwords while connected via VPN. I forgot the reason why, but you can't.

 

[compuveg]

I bet the ADS password is used as part of the encryption keys. Just a theory. When my password expires next I'll have to give it a shot while in via RDP.

 

[MTVW]

I would think you could. It worked in an NT domain.
Maybe it has to do with security...

 

[MTVW]

It works now. Made some policy adjustments and also made sure the needed ports were open.

 

[Seaspray0]

Can you provide the changes, MTVW?

A+/MCP/MCSE/MCDBA

 

[MTVW]

Well in my case when we did the upgrade naturally the settings from NT migrated over. The old NT domain policy had minimum password age was set to 30 days. I don't know who set that up. Changed it to 0 so users can immediately reset the password. This is where it should be. lol

Anyway port 464 udp/tcp should be open

 

[compuveg]

I had no problem changing my password once RDPed in through the VPN, but my laptop continued using the same password for local logins until I had it in-house and synced it up with the domain. This probably wouldn't have been the case if I had the ports listed above open.

However, the reason I am posting is to dispell my theory that the login password had anything to do with the encryption. It definitely does not.