How to Change Windows NT Account Passwords Using Internet Information Server (IIS) 4.0

MORE INFORMATION

To configure IIS so users can change their Windows NT passwords, you can use either the IISADMPWD virtual directory or the Microsoft Active Directory Service Interfaces (ADSI) provided with IIS.

Using the built-in support:

IIS 4.0 ships with the ability to allow users to change their Windows NT passwords and to notify users that their passwords are about to expire. This is done by using the IISADMPWD virtual server that installs as part of the default Web site. This feature is implemented as a set of .htr files located in the <System>\System32\Inetsrv\Iisadmpwd directory and an ISAPI extension named Ism.dll.

You can configure a site to support password changes by setting the following properties on the site: PasswordCacheTTL, PasswordChangeFlags and PasswordExpirePrenotifyDays. Refer to the IIS documentation for more details on these properties.

To allow a user to change their password, provide a link in your Web page to the following location: These properties can be set either through the MetaEdit tool that ships in the IIS 4.0 Resource Kit, or you can include the following sample script in ASP, Visual Basic, or the Windows Script Host:

   Dim IIsObj, vDay
   Set IIsObj = GetObject("IIS://LocalHost/W3SVC")

   vDay = 10

   Set new value
   IIsObj.PasswordExpirePrenotifyDays = vDay

   'Save the changes back to the data store
   IIsObj.SetInfo
				

Using the ADSI Interfaces provided by IIS:

ADSI allows access to many directory stores in addition to the IIS metabase, including Windows NT user accounts. If you use ADSI from ASP to access NT accounts, you must run an account that has administrator access to a domain controller. If your IIS server is not a domain controller, you have to establish a useable administrator security context. In this case, you cannot use the IIS 4.0 Windows Challenge/Response, you must use basic authentication or force your .asp script to run as an explicit administrator account. With IIS 5.0, you can use Windows Integrated Security as long as all your users are running Windows 2000 clients and your IIS server computer account is marked as trusted for delegation. The following is some sample code to create a new user account, <USERNAME>, with the password, <PASSWORD>, in the group, <GROUP>, and domain, <DOMAIN>:

    ' General Constants
      strDomain ="<DOMAIN>"
      strUser ="<USERNAME>"
      strGroup = "<GROUP>"

      ' Create new user with password
      Set oDomain = GetObject("WinNT://" & strDomain)
      Set oUser = oDomain.Create ("User", strUser)
      oUser.SetInfo
      oUser.SetPassword = "<PASSWORD>"
      Set oUser = nothing

      ' Add user to specific group
      Set oGroup = oDomain.GetObject("Group", strGroup)
      oGroup.Add ("WinNT://" & strDomain & "/" & strUser)
    oGroup.SetInfo
    Set oGroup = nothing
      Set oDomain = nothing

				

NOTE: On Windows NT 4.0, IIS installs a limited version of ADSI. This sample script only works on Windows NT 4.0 if you have installed the full version of namespace provider. For more documentation and a full version of ADSI, please see the following Web page:

For additional information, please see the following article in the Microsoft Knowledge Base: