October 7, 2010 – Catastrophic Failure

A while back, I posted "What you need to know about the OWA Change Password feature of Exchange Server 2007" (http://msexchangeteam.com/archive/2008/12/09/450238.aspx) on this blog. A significant pain point was highlighted there – the loss of the IISADMPWD virtual directory as a supported feature in Windows Server 2008/IIS 7.0. This prevented web client users with expired passwords from being able to change their password and log on. This was a problem for many OWA users – especially remote/mobile users that were not joined to a domain.

Good news! Exchange Server 2007 Service Pack 3 and Exchange Server 2010 Service Pack 1, running on Windows Server 2008 or Windows Server 2008 R2 have a new feature that will allow users with expired passwords to change their password. This also works for users with the User must change password at next logon specified on their AD account.

The procedure below is same for both Exchange 2007 Service Pack 3 and Exchange Server 2010 Service Pack 1. Here’s how you do it:

On the Client Access Server (CAS), click Start, click Run and type regedit.exe and click OK.
Note: If you are using a CAS Array, you must perform these steps on each CAS in the array.
Navigate to HKLM\SYSTEM\CurrentControlSet\Services\MSExchange OWA.
Right click the MSExchange OWA key and click New then click DWord (32-bit).
The DWORD value name is ChangeExpiredPasswordEnabled and set the value to 1.
Note: The values accepted are 1 (or any value not zero) for "Enabled" or 0 or blank / not present for "Disabled"
After you configure this DWORD value, you must reset IIS – the recommended method is to use IISReset /noforce from a command prompt.

Important: When you attempt to change your password, currently you cannot use UPN (johndoe@contoso.com) in the Domain\user name (contoso\johndoe) field in the ‘Change Password’ window shown below: