Changing Cached Domain Account Password - KiXtart.org - official site

You are not logged in. [Log In] KiXtart.org website » Forums » KiXtart » Lounge » Changing Cached Domain Account Password

Page 1 of 2

1

Topic Options

#104861 - 2003-09-19 04:25 PM Changing Cached Domain Account Password
MaestroG MaestroG Fresh Scripter Registered: 2002-12-30 Posts: 28 Loc: Tulsa, OK	I am using the ADSI ChangePassword method of changing the domain password with KixTart. My problem is with our VPN connected users who disconnect their VPN session before logging off. They end up having to logon to their (disconnected) PC with their old domain password and connect to VPN (the domain) with their new one. This is confusing and causes resource and access problems in the long run. Apparently, the ADSI method works and changes their password, but does not update the associated cached account password on the local system. The only thing I know of that will change both is running CTRL-ALT-DEL and clicking the Change Password button. If the VPN user is connected and then do it this way, it changes both, but we want to call it and control it in a script. Does anyone know how to update the cached domain account password so I can change it when I do the ADSI domain password change? Many thanks for your help. G
Top

#104862 - 2003-09-19 04:28 PM Re: Changing Cached Domain Account Password
Les Les KiX Master Registered: 2001-06-11 Posts: 12734 Loc: fortfrances.on.ca	First off, It's KiXtart, not KixTart! Instead of having your VPN users logon with cached creds, you should have then logon through VPN at bootup. _________________________ Give a man a fish and he will be back for more. Slap him with a fish and he will go away forever.
Top

#104863 - 2003-09-19 04:36 PM Re: Changing Cached Domain Account Password
MaestroG MaestroG Fresh Scripter Registered: 2002-12-30 Posts: 28 Loc: Tulsa, OK	Sorry LLigetfa for the typo...I seem to do that every time I post. You'd think I'd get tired of the whiplash I always get and learn. The VPN client does not integrate with the MSGina. They have to logon first and run the VPN Client.
Top

#104864 - 2003-09-19 04:39 PM Re: Changing Cached Domain Account Password
Les Les KiX Master Registered: 2001-06-11 Posts: 12734 Loc: fortfrances.on.ca	That sucks! I guess then you're snookered. You could always stick to just lowercase kixtart... a much lesser sin. _________________________ Give a man a fish and he will be back for more. Slap him with a fish and he will go away forever.
Top

#104865 - 2003-09-19 04:45 PM Re: Changing Cached Domain Account Password
MaestroG MaestroG Fresh Scripter Registered: 2002-12-30 Posts: 28 Loc: Tulsa, OK	Figured as much, but was hoping one of these scripting geniuses would know how or be able to figure it out. KiXtart still Rules! (BTW, good advice...I know I'll remember next time)
Top

#104866 - 2003-09-19 04:52 PM Re: Changing Cached Domain Account Password
Les Les KiX Master Registered: 2001-06-11 Posts: 12734 Loc: fortfrances.on.ca	Sorry, I'm stumped, but then again, I'm not one of those scripting geniuses. One thing I learned is that if you build "brain-dead simple solutions, you create brain-dead users. I say let them learn how to use the tools as they are. They will be the better for it. _________________________ Give a man a fish and he will be back for more. Slap him with a fish and he will go away forever.
Top

#104867 - 2003-09-19 05:19 PM Re: Changing Cached Domain Account Password
MaestroG MaestroG Fresh Scripter Registered: 2002-12-30 Posts: 28 Loc: Tulsa, OK	Wisely stated! I feel the same way. It's our HelpDesk group that is the squeeking wheel here saying that too many calls will be produced to handle if it is not fully automated. Hey, I've just about done everything I can. I think it's gonna come to that after all.
Top

#104868 - 2003-09-19 05:24 PM Re: Changing Cached Domain Account Password
Shawn Shawn Administrator Registered: 1999-08-13 Posts: 8611	I've been scouring MSDN looking for any API's related to changing cached credentials, nothing found so think what your trying to will be tough, even searching the web in general isn;t yielding much. What I would try, if it make sense to you, is change the domain password with ADSI, then maybe reset the secure channel from workstation to domain using NLTEST from RESKIT with /SC_RESET:<domain> switch.
Top

#104869 - 2003-09-19 05:28 PM Re: Changing Cached Domain Account Password
Shawn Shawn Administrator Registered: 1999-08-13 Posts: 8611	or, the other thing you might try, stop and restart netlogon with shelled nets: net stop netlogon net start netlogon Don't be afraid to try this, we do it all the time and it fixes a multitude of sins.
Top

#104870 - 2003-09-19 06:50 PM Re: Changing Cached Domain Account Password
MaestroG MaestroG Fresh Scripter Registered: 2002-12-30 Posts: 28 Loc: Tulsa, OK	Shawn, Tried both with no luck. I think I may open a case with Microsoft. There has got to be a way to kick off that golden code that sync's the cached password with the domain password. It does it at logoff (if you are still connected). It also does it when you do a Change Password from CTRL-ALT-DEL. Thanks everyone. I'll let you know if I find an answer outside of this site. In the meantime, keep the ideas coming.
Top

#104871 - 2003-09-19 07:23 PM Re: Changing Cached Domain Account Password
Shawn Shawn Administrator Registered: 1999-08-13 Posts: 8611	stand by ... want you to try something ... Bryce and I whipped up this little c-program that actually calls the win32 api for changing the password, before you call MS, might want to give it a try: http://www.isorg.net/kix_tools/ look for changepass.zip, in there a sml util called: CPWD.EXE that works like this: shell '%comspec% /c cpwd @domain @userid $oldpass $newPass > nul' Worth a shot, might force the cache to reset but not overly hopefull. -Shawn [ 19. September 2003, 19:28: Message edited by: Shawn ]
Top

#104872 - 2003-09-19 09:20 PM Re: Changing Cached Domain Account Password
MaestroG MaestroG Fresh Scripter Registered: 2002-12-30 Posts: 28 Loc: Tulsa, OK	Right now, it keeps telling me wrong current password. I'm trying to figure out why right now since I have verified my current password. I'll keep trying unless you know something I don't and I'll post again later if I get it working or not. G
Top

#104873 - 2003-09-19 09:32 PM Re: Changing Cached Domain Account Password
Shawn Shawn Administrator Registered: 1999-08-13 Posts: 8611	Ok, let me give a try here, what OS ? Think this one might work if we can get it going, this API is the one that allows the user to change their own password, should be the same one used by the ALT-CTL-DEL thingy ...
Top

#104874 - 2003-09-19 09:38 PM Re: Changing Cached Domain Account Password
Shawn Shawn Administrator Registered: 1999-08-13 Posts: 8611	hmmm, worked here good. changed not only my account but another local account on my wkstn here, running Windows XP.
Top

#104875 - 2003-09-19 10:32 PM Re: Changing Cached Domain Account Password
Chris S. Chris S. MM club member Registered: 2002-03-18 Posts: 2368 Loc: Earth	My guess is that G is not on AD. Also, the reason it works for Shawn is that he is now on AD. The issue at hand is that kerberos is used to change the computer account password. NTLM can be used, but requires that the user fire off the API by performing a change password by doing crtl-alt-del and choosing Change Password while connected via VPN. We had this same issue with our VPN users until we made the switch to AD. [ 19. September 2003, 22:35: Message edited by: Chris S. ]
Top

#104876 - 2003-09-19 10:49 PM Re: Changing Cached Domain Account Password
MaestroG MaestroG Fresh Scripter Registered: 2002-12-30 Posts: 28 Loc: Tulsa, OK	This is true...we're on an NT domain, but the clients are XP. Can this tool be used for NT domains? BTW, Chris, did you overcome the problem or was the fix AD? Still telling me wrong current password. G
Top

#104877 - 2003-09-19 11:03 PM Re: Changing Cached Domain Account Password
Shawn Shawn Administrator Registered: 1999-08-13 Posts: 8611	well tbh, this program was tested many moons ago when I was still on NT4, plus the tests I just performed today where from home, against local accounts on the workstation, no AD ... so not really sure whats up wid dat ...
Top

#104878 - 2003-09-19 11:08 PM Re: Changing Cached Domain Account Password
Shawn Shawn Administrator Registered: 1999-08-13 Posts: 8611	sorry, me and chris are talking about this thread offline on MSM ... question: are you running this over VPN ? if yes, could you try running it outside of VPN just to see if it works there. -Shawn
Top

#104879 - 2003-09-19 11:13 PM Re: Changing Cached Domain Account Password
Chris S. Chris S. MM club member Registered: 2002-03-18 Posts: 2368 Loc: Earth	We were looking for solutions to the issue (by the way you can find many references to this on google using keywords like "vpn cached password"). Ultimately, switching to AD has fixed it. Alternativly, you could go with Microsoft VPN. You won't get much help from Microsoft, I'm afraid.
Top

#104880 - 2003-09-19 11:19 PM Re: Changing Cached Domain Account Password
MaestroG MaestroG Fresh Scripter Registered: 2002-12-30 Posts: 28 Loc: Tulsa, OK	Actually, I'm just trying it on my XP and 2K workstations in the LAN first to see if the change password works before I try it with a laptop over VPN. I can pretty much duplicate the behavior also by changing the password and then pulling the NIC cable and then logging off. If I can't log back on with the new password, I know the cache wasn't updated. This is essentially what is happenening in our scenario when you break it down anyway. I'm not sure why this API tool wouldn't work. Are their any dependencies or some other preparation I should know about or do? G
Top

Page 1 of 2

1

Previous Topic

Previous Topic View All Topics

View All Topics

Index Next Topic

Next Topic

Moderator: Arend_, Allen, Jochen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Mart

Hop to:

Shout Box

Who's Online

0 registered and 987 anonymous users online.

Newest Members

StuTheCoder, M_Moore, BeeEm, min_seow, Audio
17884 Registered Users

Generated in 0.074 seconds in which 0.026 seconds were spent on a total of 13 queries. Zlib compression enabled.

click tracking