User Must Change Password at Next Logon

Bulletin: 110907-2

Software Effected:
ServerMigrator, Resemble, PasswordCopy, Domainreconfigure

Issue:
After performing a member server migration, the passwords were copied sucessfully but it appears that the accounts are being prompted to change the password at next logon. Is there a setting we can change so users are not prompted to change their passwords?

Solution:
In Windows Server 2000 and 2003, if password is set using the Winzero paswordCopy method, the "user must change password at next logon" attribute is set automatically by the system so users are forced to change the password at next logon.

Winzero password Copy functionality has an extended process to unselect the "User must Change password at next logon" feature. However, server policies or domain policies may over ride this process.

We have included a utility in ServerMigrator to report and manage pasword properties to unselect one or more accounts "user must change password at next logon" property.

A second method, the preferred solution is to use a registry key to control this.

Key: HKEY_LOCAL_MACHINE
Path:\System\CurrentControlSet\Control\Lsa
Value name: SamRestrictOwfPasswordChange
Data type: REG_DWORD
value: 0

If this key does not appear then create it with the value of 0 (zero) if the key does exist then change the value.

Remote Computers Not Reachable by Name

Bulletin: 032007-1

Software Effected:
All Winzero Solutions Using ScheduleManger: DomainReconfigure, ServerMigrator, PasswordCopy, SVRCompare, RemoveUnknown

Issue:
When trying to add computers to the ScheduleManager in order to update or migrate workstations and servers, the list of available computers does not include computers that are known to be members of the domain.

Solution:
This issue may arise from 3 different possibilities:

The computer is not reachable by Name. DNS or WINS is not configured correctly at either the computer that is not appearing, the Domain Controllers of each domain where the migration is being performed or the computer used for the migration.

The computer is hidden from the browser
Routers are not broadcasting NetBios Names
Check that all computer DNS settings involved in the migrations are pointing to the target domain's DNS server.

If Windows NT4 is the source domain all computer WINS settings in both the target and source domain must be set to point to the WINS server in the Source domain.

If all computer DNS and/or WINS settings are configured correctly then Netbios Broadcasting is not occurring. To resolve this situation add or edit the LMHost file of each remote computer, the domain controller of each domain and the computer running DomainReconfigure to include the non visible computers, domain controllers and the DomainReconfigure computer.


Issue Solution Courtesy of the IT Staff at Charlotte State Bank(FL)

Winzero ScheduleManager Rights

Bulletin: 081707-1

Software Effected:
Software Using Winzero ScheduleService: DomainReconfigure, ACLReporter, ServerMigrator, PasswordCopy, SVRCompare, RemoveUnknown

Issue:
When sending an information collection or modification job to a remote server or workstation, the following error or errors are returned and the job is not completed:

- Can not import password list
- Can NOT locate Folder Permission File
- Can NOT Import Passwords from DCs or PDCs...
- Import File Not Copied

These errors occur after a remote job has been sent to a workstation or server and the job is launched correctly. The ScheduleService is running on the remote computer but the job did not collect and save the information locally on the remote computer.

Solution:
This situation occurs when the service account does not have adequate rights and privileges on the remote computer.

The service account must be a member of the local Administrators group of the remote workstation or server directly or indirectly through group membership.

The service account must not be the local administrator account. The local administrator account does not have rights back to the computer running the Winzero software. (If the computers are in a workgroup, then the Administrator account can be used; however the password for the Administrator accounts on all computers must be the same).

If Domain information is being set or retrieved the Service account must also be a member of the Domain Admins Group or Enterprise Admins group in each domain information is collected or set.

You can check the state and the properties of the Winzero Scheduler Service for a specific computer to determine whether or not the Winzero Scheduler Service is running, or is configured correctly to run on the specified computer.

In the Managed Computers frame of the Winzero ScheduleManager, double-click the computer.
The properties and a description of each property are listed in the Properties and Description frame of the ScheduleManager window

See SheduleManager Help file for detailed information.

Active Directory LDAP Ports

Bulletin: 081507-1

Software Effected:
DomainReconfigure, GroupManagerPlus

Issue:
When creating, modifying, renaming or changing properties for a large number of objects in Windows Active Directory 2000 or 2003, at approximately 300 to 400 objects (users, groups, etc) the application stops the create, modify rename or properties change process. This is a Microsoft flaw in LDAP.

When creating LDAP ports (each time you change an entry in AD) Windows creates a LDAP connection. However, the connection does not close for 15 minutes. Therefore Windows runs out of available LDAP Ports and all operations stop working.

Solution:
Winzero and Microsoft have developed a solution to
address this issue.

On the computer running the Winzero application and the PDC Emulator
(see below how to find the PDC emulator) add or modify the
registry DWORD Value setting for:

HKEY_LOCAL_MACHINE
SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
MaxUserPort should be set to 65534 (decimal) or fffe (Hex)

If this entry does not exist create a DWORD value or modify it to the correct entry. This is the maximum value and it will give you enough ports to modify 10000 objects.

To find the PDC emulator, download our free utility DirectoryObjectExtractor and extract the PDC Emulator. Download Now