Microsoft KB Archive Search

Notice: This website is an unofficial Microsoft Knowledge Base (hereinafter KB) archive and is intended to provide a reliable access to deleted content from Microsoft KB. All KB articles are owned by Microsoft Corporation. Read full disclaimer for more details.

  1. Home
  2. "You do not have permission to change your password" error message

"You do not have permission to change your password" error message

Author: Rory McCaw MVP

View products that this article applies to.

SUMMARY

When a domain user authenticates to a Windows Server 2003 DC with SP1 from an XP Pro-SP1 computer and their password has expired, they receive a message "Your password has expired and must be changed."

↑ Back to the top

SYMPTOMS

When a domain user authenticates to a Windows Server 2003 domain controller with SP1 from a Windows XP Professional-based computer with SP1 and their password has expired, they receive a message "Your password has expired and must be changed." When they try to change their password, they receive the message: You Do Not Have Permission to Change Your Password." This is different from the message "You are required to change your password at first logon" which a user would receive when their user account properties have been set to 'User must change password at next logon'. The error message "Your password has expired and must be changed." is specific to accounts with expired passwords. This problem does not prevent a user with administrative permissions to force a password change for the user or restrict that user from then changing the password once successfully logged on and authenticated to the domain by using the CTRL + ALT + DEL key sequence and clicking 'Change Password' in the Windows Security dialog box.

↑ Back to the top

CAUSE

In a Domain with GPO security restrictions in place, specific group policy settings change with the installation of Windows Server 2003 SP1 and can cause this problem. If you have followed and implemented the recommendations in the Windows Server 2003 Security guide, you may have configured the 'Network Access: Named pipes that can be accessed anonymously' and set this to a blank value. This GPO setting makes changes to the registry key HKLM\System\CurrentControlSet\Services\LanManServer\Parameters\NullSessionPipes. On a domain controller running Windows Server 2003 without SP1, the default values are COMNAP, COMNODE, SQL\QUERY, SPOOLSS, LLSRPC, EPMAPPER, LOCATOR, TrkWks, TrkSvr but these values change when Windows Server 2003 SP1 is installed to include COMNAP, COMNODE, SQL\QUERY, SPOOLSS, LLSRPC, BROWSER, NETLOGON, Lsarpc, samr.
 
If your existing GPO setting value is set to blank for the setting 'Network Access: Named pipes that can be accessed anonymously' and Windows Server 2003 SP1 is applied, when you view the value of the registry key or run a RSOP in GPMC, the value will appear blank however when you open the GPO and view the setting, it appears with all of the new Windows Server 2003 default settings: COMNAP, COMNODE, SQL\QUERY, SPOOLSS, LLSRPC, BROWSER, NETLOGON, Lsarpc, samr.

↑ Back to the top

RESOLUTION

To resolve this issue, open the GPO where the 'Network Access: Named pipes that can be accessed anonymously' setting is configured, double click on the setting and clear the Define this policy in the template check box and click OK. Double click on the 'Network Access: Named pipes that can be accessed anonymously' setting again and enable the Define this policy in the template check box. Leave the new defaults that will be added automatically and click OK. Close the Group Policy Object Editor and run gpupdate /force at the Command Prompt on your domain controllers to force the change or wait 5 minutes for the setting to take effect.

↑ Back to the top

MORE INFORMATION

More information on similar error messages with different resolutions and causes can be found in KB316806, KB32881, and KB328817 as well as at in tips 7344 and 7516.

↑ Back to the top

Community solutions content disclaimer

Microsoft corporation and/or its respective suppliers make no representations about the suitability, reliability, or accuracy of the information and related graphics contained herein. All such information and related graphics are provided "as is" without warranty of any kind. Microsoft and/or its respective suppliers hereby disclaim all warranties and conditions with regard to this information and related graphics, including all implied warranties and conditions of merchantability, fitness for a particular purpose, workmanlike effort, title and non-infringement. You specifically agree that in no event shall Microsoft and/or its suppliers be liable for any direct, indirect, punitive, incidental, special, consequential damages or any damages whatsoever including, without limitation, damages for loss of use, data or profits, arising out of or in any way connected with the use of or inability to use the information and related graphics contained herein, whether based on contract, tort, negligence, strict liability or otherwise, even if Microsoft or any of its suppliers has been advised of the possibility of damages.

↑ Back to the top

Keywords: kbpubmvp, kbpubtypecca, kbhowto, KB555340

↑ Back to the top

Article Info
Article ID : 555340
Revision : 3
Created on : 4/20/2018
Published on : 4/20/2018
Exists online : False
Views : 738