Active Directory – Change User’s Password – Erroring

 

Preface

This is a difficult post as it does not demonstrate a remedying process.

It merely demonstrates a stumbling block, we ran into as we tried to change an Active Directory Service Account’s password.

BTW, a couple of choices for changing an AD’s Account password are documented here.

 

Changing AD User Password : Attempting

UI

Active Directory Users & Managers

Reset Password

resetpassword

 

Reset Password – Access is Denied

accessisdenied

 

Console

dsmod

Tried to change password using dsmod

Batch File


@echo off

Rem Change a domain account’s password from the command line	
Rem https://itnsomnia.wordpress.com/2008/04/08/change-a-domain-accounts-password-from-the-command-line/

set "_SAMAccountName=SQLSvc"
set "_ADPassword=antelopeWASBEFOREME#"

echo ADUser
dsquery user -samid %_SAMAccountName%

dsquery user -samid %_SAMAccountName%  | dsmod user  -mustchpwd no -pwd %_ADPassword%

Echo ERRORLEVEL is %ERRORLEVEL%



Output


ADUser
"CN=MSSQLsql,OU=ServiceAccounts,OU=LAB,DC=AD"
dsmod failed:CN=MSSQLsql,OU=ServiceAccounts,OU=LAB,DC=AD:Access is denied.:Set password failed
type dsmod /? for help.
ERRORLEVEL is -2147467259
>

 

 

Diagnostic

Active Directory Users And Computers

User’s Properties

Per-using Active Directory Users and Computer, here is the AD Account’s setting:

accountproperties-account

 

Explanation

  1. User must change password at next logon
    • Set
      • Good
  2. User cannot change change password
    • Not Set
      • Good
  3. Password never expires
    • Set
      • Good

Conclusion

From a simple User Property review, nothing should stop this Service Account from changing its own password.

In a follow-up post, will review whether restrictions have been set at the Organization (ou) level.

 

One thought on “Active Directory – Change User’s Password – Erroring

Leave a Reply

Please log in using one of these methods to post your comment:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s