RSS

how to 在用户密码过期后依然可以登录owa来修改密码

28 Oct

owa的用户密码修改的功能在iis6中,是通过IISI中提供的IISADMPWD提供的。虽然通常情况下,用户密码过期后是无法登陆owa的,但是实际上owa的密码修改功能是可以满足下列情景的需求:

  1. To change their password after they have logged on to their mailbox by using Outlook Web Access
  2. To change their password if their password will expire within a given time period
  3. To change their password if their password has already expired
  4. To change their password if the User must change password at first logon is enabled
  5. To change their password if the User cannot change password option is enabled

这里我们主要是满足前4项的需求。需要去修改iis的一项属性passwordchangeflags。默认iis的该属性赋值为6,你可以通过下面的命令获取当前状态:

为了满足需求,执行下面的脚本

具体这些值的意义见下表

Value Setting
0 An SSL connection is required to change passwords
1 An SSL connection is not required to change passwords
2 Password changing is disabled
4 Password expiration notification is disabled
6 Password changing and password expiration notification are disabled

 

用户在下次登录必须修改密码的状态下,依然可以使用旧密码登录。如果这次登陆没有修改密码,那么注销后将依然可以旧密码登陆。登录后会有如下提示:

修改密码后,可能会因为ad复制的关系,导致对勾未取消。等待一段时间以新密码登录即可正确取消该对勾。

 

补记:

针对exchange 2003或者exchange 2000,你可以修改注册表来实现类似的功能:

  1. 在cas上启用IISADMPWD功能,在之前的文章有具体做法,我就不放了。
  2. 每个后端 Exchange 2003/2000 上在HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSExchangeWeb\OWA下创建
    type:   DWORD Value
    name:  DisablePassword
    value:
      0
  3. 在cas上修改inetmgr的 Web Service ExtensionsAllow功能Active Server Pages

【update】让用户在登录到邮箱之前就必须修改密码

1、执行命令

cscript.exe adsutil.vbs set w3svc/passwordchangeflags 0

2、inetmgr中修改

2.1 扩展

  1. 创建IIS虚拟目录
  1. 修改虚拟目录属性
  2. 确认application pool为MSExchangeOWAAppPool
  3. 确认匿名访问启用
  4. 执行命令regsvr32 c:\windows\system32\inetsrv\iisadmpwd\iispwchg.dll

额外可以去检测下列值是否正确。

Value command
0 cscript.exe adsutil.vbs get w3svc/passwordchangeflags 
/iisadmpwd/achg.asp cscript.exe adsutil.vbs get w3svc/AuthChangeURL 
/iisadmpwd/aexp.asp cscript.exe adsutil.vbs get w3svc/AuthExpiredURL
/iisadmpwd/aexp3.asp cscript.exe adsutil.vbs get w3svc/AuthExpiredUnsecureURL
/iisadmpwd/anot.asp cscript.exe adsutil.vbs get w3svc/AuthNotifyPwdExpURL
/iisadmpwd/anot3.asp cscript.exe adsutil.vbs get w3svc/AuthNotifyPwdExpUnsecureURL 
  N/A cscript.exe adsutil.vbs get w3svc/PasswordExpirePreNotifyDays

             

实际使用情况状态

当密码过期登录账户登录owa后,会直接跳转到密码修改页面

注意此时修改密码的账户需要使用upn或者sam账户全名

密码修改成功后会返回下面的页面

点击owa连接后,会返回owa的fba页面,其下端会报登录失败的提示,可以忽略。

以上已经可以满足需求。但是建议修改页面的美观度,并添加相应的密码策略提示。

Advertisements
 
Leave a comment

Posted by on October 28, 2009 in Exchange Server

 

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

 
%d bloggers like this: