User cannot change password?

[Rich]

What restrictions are set for users other than the account
restrictions "user cannot change password" that might
prevent a user from changing a password? I have my domain
user account that expire but still will not allow the user
to change them when logging in on the local PC. We have a
citrix system that will allow the user to change the
password when logged into it.

Seems kind of strange that it would work in one place and
not the other. Should I have a global group placed into a
group on the local computer that would give them rights to
change the password when logging into the system from a pc
instead of Citrix?

Thanks for the help.

Rich

 

[Paul Bergson {MCT, MCSE}]

This kinda sounds like they really aren't authenticating onto the domain,
like they are getting authenticated via cached credentials. Have you had
the user in question try logging onto a different workstation other than the
citrix connection or the local workstation? Have you been able to change
the password for the user and have them log in on the machine in question
and see if they can still authenticate? Are there any errors on the dc when
the user is trying to change the password? To short, etc...? Do you have
any third party password policies systems in effect that overrides
Microsoft's policies?

 

[Rich]

I am not aware of any third party policies in place but I
have only been with the company for a couple of months.
Needless to say I have spent most of that time cleaning up
several issues with AD. The user in question can log in
to the domain from any Thin client and change the
password. The user can use the new password to log into
the domain on a PC but cannot change the password on the
PC for the domain. This is prevelant over the domain. If
a user logs into a domain on a PC they can't change the
password. They must change the password from the Citrix
prompt.

Thanks for the help.

Rich

 

[Paul Bergson {MCT, MCSE}]

Enable auditing on account logon's and check to see if/what type of error is
being listed in the security event log on the dc the user is authenticated
to.