Recipe8.9.Allowing Password Changes Through OWA

Recipe 8.9. Allowing Password Changes Through OWA

Problem

You need to allow users to change their passwords through Outlook Web Access.

Solution

Using a graphical user interface

To create the required virtual directory for password changes, do the following:

1. Open the IIS Manager snap-in from the Administrative Tools menu in the Start menu.

2. Expand the Web Sites object.

3. Right-click the Default Web Site object and choose New Virtual Directory.

4. The welcome screen of the Virtual Directory Creation Wizard appears; click Next.

5. Enter iisadmpwd in the Alias field and click Next.

6. In the next wizard page, set the path for the new directory to %Systemroot%\System32\Inetsrv\Iisadmpwd and click Next.

7. Set the Virtual Directory Access Permissions to Read, Run Scripts, and Execute. Click Next and Finish.

8. You should now see the new Virtual Directory listed in the IIS Directory structure.

Once your directory is created, you can edit the registry to enable the Change Password button.

1. Log on to the OWA server.

2. Open the Registry Editor (regedit.exe).

3. Select the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSEx-changeWeb\OWA registry key.

4. Choose New DWORD Value from the Edit menu; name the new value DisablePassword.

5. Double-click DisablePassword and set the value to 0.

6. Restart the IIS services with the iisreset command-line tool.

Discussion

Out of the box, OWA doesn't provide a method for users to change their passwords. For users who log on to a domain every day, that's no problem, since they can always change their password directly from their workstation. However, anyone who uses OWA remotely will be out of luck unless you provide them a method to change their passwords when necessary.

Once you have enabled SSL on your OWA server, you can allow your users to change their password through OWA. SSL is required because Microsoft correctly reasoned that allowing people to set up a mechanism to change passwords without it would be insecure. The password-changing mechanism itself is implemented by IIS, and IIS includes all of the necessary components; you only have to enable them. OWA can expose a convenient button to change the password, but only after you make the registry change described above.

See Also

Recipe 8.7 for setting up SSL, MS KB 321582 (The Outlook Web Access Change Password Options Does Not Function), MS KB 314308 (You cannot change your password in OWA if the front-end server and the back-end server are running different types of operating systems), MS KB 833734 (You experience various problems when you use the Password Change pages in IIS 6.0), and Restarting IIS (http://www.microsoft.com/resources/documentation/iis/6/all/proddocs/en-us/wsa_restartingiis.mspx), which has some good information on iisreset