XP Password Change Fails in Windows 2k Domain

[Bill]

Hello all,

We recently introduced about eight new Windows XP
Professional SP1 PC's into our Windows domain (Domain
Server runs Windows 2000 Server SP3). Everything seems to
be working fine and all of the machines are working well
together; however, we require users to change their
passwords every sixty days and now the XP machines will
not change the users passwords. Okay here's some more
detail:

The user logs in on a Windows XP box and the standard
Windows message comes up saying you need to change your
password in X days, do you want to do it now. If they
click yes and try to change it, it will say you do not
have permission to change your password. Now if the user
performs the same operation on a regular Windows 2000 SP3
workstation (remember we have a mixed bag here) the
operation works fine. Now to make things even weirder, if
the user clicks "No, I do not want to change it now," and
then logs into Windows normally (on XP again), upon
logging in performs the three finger salute
<Ctrl><alt><Del> and clicks "Change Password" he/she can
change the password without any problems.

So in summary the XP machines will only not allow a
password to be changed at the main login where it gives
you the option to change your password now since it's
expiring soon. I have looked around but I am not quite
sure what would make it react this way here, but upon
logging in allow the users to change their password.

I have made sure that the Group Policy in A/D gives
the "Everyone group" access to Change their Password.
Also, I verified that no user has the box "User Cannot
Change Password" checked. If anyone has experienced this
problem, or can help me resolve this issue it would be
greatly appreciated! It's just pretty annoying to tell
users, completely login, than change your password.

Thanks for any help that you can provide!

Bill

[Bill]

Moderator:

Please close this question out. After weeks of searching
I have finally resolved this issue. The "Additional
restrictions for anonymous connections" was enabled in the
Domain Security Policy. After removing this restriction
users were then able to change their passwords on Windows
XP machines. Thanks.

>.
>

[Steven L Umbach]

I knew that caused problems with downlevel clients, but not "uplevel"
clients?! --- Steve

"Bill" <psuw...@yahoo.com> wrote in message
news:4d4801c2f3bc$04076570$3401...@phx.gbl...