In yesterday’s post we looked at an issue with the IIS 7 architecture where Windows and Basic authentication fail when the “User must change password at next logon” flag is set for an Active Directory user. Microsoft engineered IIS 7 to deny access to users who have this flag set. This change from previous versions of [...]
A Workaround in IIS 7 for the “User Must Change Password at Next Logon” Flag in Active Directory
A Replacement for IISADMPWD in IIS 7
Many organizations have employed Microsoft’s IISADMPWD tool to allow password changes in Active Directory for web applications. Originally intended as the way to change passwords for access in Outlook Web Access (OWA), IISADMPWD became quite a useful solution for any organization that wanted to delegate access to AD password changes via a web application. With [...]
Adding Windows Computer Accounts from Active Directory to NTFS ACLs to Control Permissions
When writing web applications, you often must grant permissions to an application to do something on other machines in a Windows domain or forest. IIS 6, 7 and 7.5 all allow you to configure IIS application pools to run under specific, rather secure identities like NETWORK SERVICE and the Application Pool Identity. When accessing resources [...]
Run IIS Web Applications on a Windows Member Server and Not a Domain Controller
Most of our software products run on Microsoft’s IIS web server. In our product installation guides, we specify in the system requirements to install our web applications on a member server instead of a domain controller. Recently, a prospect asked us why we recommend this since WebAD products connect to Active Directory. Is it really a best [...]
PowerShell Hosting in ASP.NET: Resolving Errors with PowerShell Set-ExecutionPolicy
One of the great innovations in Windows PowerShell is the ability to host the PowerShell run-time environment in any number of run-time hosts. We use this capability to host PowerShell in an ASP.NET web application process for our PeopleProvision solution. Everything works great once you get over a couple of big security hurdles. File SomePowerShellFile.ps1 [...]
Active Directory Provisioning with PowerShell: Extensibility and Power without Costly Implementation (Part 4 of 4)
We’ve been looking this week at Web Active Directory’s new PeopleProvision solution for automating and delegating the Active Directory account creation process. Today we present the final post of our blog series and look more closely at PowerShell’s role in the PeopleProvision platform. PowerShell empowers PeopleProvision to deliver the most business value by providing extensibility and [...]
Active Directory Provisioning with PowerShell: Extensibility and Power without Costly Implementation (Part 3 of 4)
This is Part 3 of Web Active Directory’s blog post series highlighting our new PowerShell-enabled platform. We introduced the series with an exam of how other software vendors approach provisioning with costly implementation services and then looked at WebAD’s PeopleProvision solution more closely. In this post, we look at how easy it is to implement [...]
Active Directory Provisioning with PowerShell: Extensibility and Power without Costly Implementation (Part 2 of 4)
We are taking a look at Web Active Directory’s new PowerShell-enabled platform this week in a series of blog posts. We introduced the series by discussing how many software companies like to squeeze every red cent from their customers by using proprietary technologies that require costly implementation services. This post introduces WebAD’s PeopleProvision tool to [...]
Check “User must change password at next logon” Flag in Active Directory
I posted about Microsoft’s IISADMPWD tool and IIS 7 issues recently. The IISADMPWD tool allows Active Directory users to change AD password in versions of IIS prior to IIS 7 and the primary intent of this tool is to allow Outlook Web Access users before Exchange 2007 to change their AD password. Changes to IIS [...]
IISADMPWD: IIS 7 Authentication with “User must change password at next logon” Flag Set in Active Directory
We’re working with a customer to replace the Microsoft IISADMPWD tool the customer uses to allow Active Directory password changes in their hosted software offering. This tool, a legacy ASP application that runs on IIS 5 and 6, has been around for a while to allow AD password changes using OWA, Outlook Web Access. Beginning [...]
- Office 365 and BlackBerry Calendar Synchronization: A Replacement for BlackBerry Enterprise Server Functionality July 7, 2011
- Office 365 and BlackBerry Enterprise Server Express July 8, 2011
- Windows Active Directory Cached User Credentials June 9, 2011
- RIM Gets Closer to Cloud-Based BlackBerry Enterprise Service (BES) for Office 365 August 15, 2011
- Efficient Queries with LDAP Search Filters March 30, 2012
- System.Security.SecurityException Writing to the Application Event Log on Windows Server 2008 with ASP.NET 4.0 April 6, 2012
- Redirect HTTP to HTTPS on Microsoft IIS 7 and 7.5 April 2, 2012
- Efficient Queries with LDAP Search Filters March 30, 2012
- Create a Code Signing Certificate on Windows Server 2008 with OpenSSL and pvkimprt March 29, 2012
- Configure ASP.NET with Load Balancing on a Web Farm to Avoid ViewState Errors March 23, 2012
-
Jason Cox: We work with Microsoft Active Directory and the AD...
-
Engin: Great article. thanks for posting....
-
Feruza: If you set the port for OpenDS to 389, it means th...
-
Jason Cox: This doesn't sound like a SQL Server engine issue...
-
vic: Advise isn't helpful. Still get the same error me...
Blogroll
- Active Directory Powershell Blog
- Active Directory Tools Review
- Brian Desmond’s Blog
- Brian Desmond’s Blog
- Dirk Adamsky’s Scripting Blog
- Florian’s Blog
- IT Geared
- JFRMilner’s Tech Blog
- Mark Parris’s blog
- Microsoft Active Directory resources for Server 2008 R2
- Mike Kline’s AD is Fun Blog
- Mike Kline’s AD is Fun Blog
- Stuart Coney’s Blog
- Tim Springston’s Active Directory Blog
- Ulf B. Simon-Weidner’s Blog – Directory Services/Active Directory






