Remote Password Change

[booman]

My work has users that are not part of the domain (off-site) and we have configured a user account and exchange email.
They use the Outlook Web Access to view emails.
Is there a way to allow them to change their password without being in the network on the domain?

I found there is a setting on the OWA server (Win Server 2003) that allows a password button in Outlook Web Access, but its way beyond my experience.
It requires some visual basic command, registry tweaks and other stuff.
OWA Password
I don't want to be responsible for screwing up everyone's email and crashing the server.
Can you guys think of another way where they can change/update their passwords?

[Aedan]

The config for Exchange 2003 (which I presume is what you're using) is as MS describe, but it's not really a big deal. You should already be running OWA over SSL anyway if you've exposed it to the Internet (and if you haven't - why haven't you!?!) I'm also assuming you only have one box that handles both Exchange and OWA - is that true?

The process for enabling password change over OWA seems to be fairly straightforward - one change to the IIS server via the adsutil.vbs script, configuring a virtual directory and then enabling the change password button in OWA.

In terms of changing things - you guys do have a backup don't you?

[booman]

We are running one server for Exchange and another server for OWA.
They are both backing up every night incremental and every week full.

I did the adsutil.vbs script change through command line, but there is a registry change that I don't want to screw with.
What about those updates?
How do I know if OWA has the correct updates?

[Aedan]

How do you know if OWA has the correct updates? Check the page that lists the update requirements. You'll find a section that says the following:

Note The files from this hotfix are included in Windows Server 2003 Service Pack 1 (SP1). This hotfix package automatically registers Iispwchg.dll. However, you must manually register this DLL if you install Windows Server 2003 SP1. For more information, see the "More Information" section.

So, if you have SP1 or above installed installed (and you really should have SP2 installed - it was released in 2007!), you don't need to install the patch, as it's already installed.

If the install media for the server was SP1, you will have to register the DLL file. Now, you might not know if this is the case, but it should be safe to reregister a dll, even if it's already registered.

As for the registry entry - make a backup of the affected section of the registry before. That way you can always merge back the changes. In this case, you're only enabling the OWA password change button, which is disabled by default.

[booman]

I'm pretty sure both servers are updated to service pack 2.
You are right, its really only two changes and they are pretty simple.
So I'll have to do it over a weekend and will back up the registry and the script file, just in case it breaks something.

Thanks for your help, I'll keep you updated on my progress.

[Aedan]

It'll be good to hear how it goes!

[booman]

I havn't done it yet. The change was approved by my boss, so now I'm waiting for the right weekend to make the change and test it.
I just moved the last two weeks and didn't even have email.

[Daniel ~]

I could send one if you like, it's not like were strangers or anything...

I just learned I can send you a song from rhythmbox!?

[booman]

I tried the password in outlook web access, but it didn't work.
Steps taken:
1. passwordchangeflags 1 (in adsutil.vbs)
2. created virtual directory in c:\winnt\system32\inetsrv\iisadmpwd
3. created the registry value: DisablePassword type: REG_WORD data: 0

Now I have to go back and make sure all the proper updates are applied on the server.
I'm almost scared to do updates because if it breaks something I will have a VERY hard time undoing it.

[Daniel ~]

Are WE ever brothers in arms!! Back up EVERYTHING, twice if you can, then go forth in resolute courage!

( That's what I "try" to do...":O}

[booman]

I checked the server again and found that #3 was still set to "1"
maybe that was my problem. Just have to restart, which is difficult during the day when people need emails on their phones

[Daniel ~]

How long does one of your servers take to re-boot?

[booman]

hmm, not sure. It depends on which server. That one will probably take 10 minutes... maybe.
I'm sure no one will die if they can't get an email for 10 minutes, but I'm more worried about if my changes screw up something, I will need to undo them and that takes more than 10 minutes.

[Daniel ~]

Ah...yes....there is always that...":O}

[booman]

It actually worked. I restarted the server and now there is a password button. Of course when I click it there is a pop-up window with a 404 error, but I'm halfway there

[Aedan]

Excellent work so far then!

[booman]

yup, for some reason its supposed to display an .asp file with a simple form where the user can enter their new password. Its probably just permissions

[booman]

I finally got it working...
I found another tutorial and went through all the steps again.
Ironically the Microsoft instructions included some times for the 404 error I was getting... that was a surprise!
Anyways, it works great, now we can change the network password through Outlook Web Access.