Domain users and password errors

elewis521

Honorable
Oct 3, 2014
112
1
10,685
Good morning,

We have a domain server running 2003 (Yes I know it's ancient). Here lately several users have been locked out. I have reset their password on the domain and I have set it up for them to type in a generic password and when they enter it they input their own password like normal. It seems that this issue is hitting people at random. I have no idea what is causing this issue and why it is effecting random users. Any help will be GREATLY appreciated!

Thank you!
 
Solution
What is the specific error message/s presented when you try?

Do you have password rules set, and are you double checking that the new password conforms to those rules?


Scan every affected computer for virus/malware. Use no fewer than 3 different products. Remove the hard drives and connect them externally to known clean machines for scanning.

Check, double-check, then triple-check all DNS settings.

Unjoin/rejoin the affected computers.

As a last resort, unjoin the affected computers and delete their computer records from AD, then rejoin.
" The user's password must be changed before logging on the first time."
That's not an error. You've reset the user's password and left checked "User must change password". When you do this the user must change the password you set on first use. People getting locked out is 99% their own fault, they enter their password incorrectly too many times and trigger the lockout. They will ALWAYS tell you they didn't do that.
 
except when they have their phones set to hit the mail server. They change the password on the computer, but if they don't also change it on their phone (mobile device) their account will get locked out. This has plagued us for years, and users just don't get it.
 
What is the specific error message/s presented when you try?

Do you have password rules set, and are you double checking that the new password conforms to those rules?


Scan every affected computer for virus/malware. Use no fewer than 3 different products. Remove the hard drives and connect them externally to known clean machines for scanning.

Check, double-check, then triple-check all DNS settings.

Unjoin/rejoin the affected computers.

As a last resort, unjoin the affected computers and delete their computer records from AD, then rejoin.
 
Solution

That's configurable. By default it's not set and passwords can be changed as often as desired. In addition, even when a minimum time is set a forced password reset from the console is exempt.