RDP connection issue

[pampecik]

Hi guys.

 

I have a problem with a server running Windows Server 2012. When i set user needs to change password when he logs in a following message pops on client PC:

 

You must change your password before logging on the first time. For assistance, contact your system administrator or technical support.

 

If I recall correctly it used to pop change password screen. I found hotfix on M$ support website. However it's for Win Server 2008R2. ( https://support.microsoft.com/en-us/kb/2648402 )

Anyone had same issue? 

 

PS: Sorry for bad english, I am from Poland.

[zMeul]

https://social.technet.microsoft.com/Forums/en-US/ce6dc4ab-71eb-4a5d-ac5b-8fac34c8570b/must-change-password-before-logging-in-the-first-time-windows-server-2012-r2-standard-edition?forum=winserverTS

[pampecik]

I tried it and there's a problem when I get to change password screen. After I input new password there's "Access denied" message. Do I need to assign user to another group? User now is in "Users" and "Remote desktop users".

Also there's recommendation client should use it only to change password. If I set password policy to last for like 30 days or so I will have to change it back and forth very often. There's like 15 users connecting to this server via remote desktop. That will be really painful to change it for everyone every 30 days just to let them change password. There's no other way? Preferably server side configuration.

[ProjectBox153]

Do you need to have the users change their password every so often? What is the server used for?

[pampecik]

Server holds ERP app and users in other location connects to it. I don't need them to change password that often, my boss told me to make it happen, and I am sitting right here pulling my hairs out and trying to make it work. There's no option to just talk to me he is really stubborn person about data security after his data was stolen. I tried proposing other options like files encryption, but as I said he is really stubborn.

[ProjectBox153]

There is a way to disable the "user must change password every so often" thing. I think it's a simple registry edit, but I can't remember. I did it on my server, because I share it with other, less tech inclined people.

[pampecik]

Well I know how to change password policies so user won't have to change password every 30 days or so. I don't know how to let them change it. Whatever i do there always this thing.

 

You must change your password before logging on the first time. For assistance, contact your system administrator or technical support.

 

Or if i put " enablecredsspsupport:i:0 " this little thingy in .rdp file after putting new password to change there's "Access denied" message. 

 

BTW I just discovered that I can change password normally using Win 7 machine. However clients connecting to this server are using Win 8.1 and Win 10 machines.

[ProjectBox153]

Have you tried logging into the user accounts locally on the server? This fixed the issue for me.

[pampecik]

That works, but doesn't solve issue for me. I'll have clients travelling +200km just to change passwords. I need something to work like on the picture attached. It used to work like this in Win 7. When I log on user that needs to change password with Win 7 machine I have this exact screen that allows me to change password and start working right away.

[ProjectBox153]

15 minutes ago, pampecik said:

That works, but doesn't solve issue for me. I'll have clients travelling +200km just to change passwords. I need something to work like on the picture attached. It used to work like this in Win 7. When I log on user that needs to change password with Win 7 machine I have this exact screen that allows me to change password and start working right away.

 

Just set up the accounts and then have the client tell you what the password should be. Set that as the password, and done. Then the client can log in with the account having been already set up.

[Mikensan]

The machine they RDP from is not on the domain? If so, why not just change the password before they RDP in? Hoping you do not allow RDP from non-domain computers.