[22207] in Kerberos
Re: Problem changing expired Windows 2000 passwords
daemon@ATHENA.MIT.EDU (Douglas E. Engert)
Tue Aug 17 10:11:53 2004
Message-ID: <412210F3.5090607@anl.gov>
Date: Tue, 17 Aug 2004 09:06:43 -0500
From: "Douglas E. Engert" <deengert@anl.gov>
MIME-Version: 1.0
To: rodolfo@ime.unicamp.br
In-Reply-To: <1121.143.106.77.85.1092748372.squirrel@webmail.ime.unicamp.br>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
cc: kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
rodolfo@ime.unicamp.br wrote:
> Hi!
>
> We have a Windows 2000 domain with workstations performing authentication
> at a MIT Kerberos KDC. It works fine but, if the user's password has
> expired, the Windows workstations displays it's normal "password expired"
> alert, but when the user tries to change this password, Windows shows the
> "domain not available" message.
>
> Running tcpdump at the kdc, I show no kerberos related traffic when this
> password-change is tried.
>
> There is a article at Microsoft about a similar problem, but it says the
> issue is solved with service pack 1. We have service pack 4 at our
> windows workstations.
When you ran ksetup on a client did you use the /AddKpasswd option?
It could be that SP1 is using the "older administrative protocol" which
was used by the v5passwdd. You might try running v5passwdd.
I say this as I know the older krb5.exe on windows had a password change
option, and the krb5.exe could talk to AD to change a password in AD.
So Microsoft may have implemented the other direction as well,
and allow a Windows machine to change a password in an MIT realm,
but you may have to use the /AddKpasswd option to tell it where it is.
>
> Some idea???
>
> Tnks!
>
> []s!
> Rodolfo
>
>
> ________________________________________________
> Kerberos mailing list Kerberos@mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos
>
>
>
--
Douglas E. Engert <DEEngert@anl.gov>
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
