Cannot change the user's password

Hi, everyone

Today I tried to change the user's password but the following error message
was shown on the screen

Windows Cannot complete the password change for User AAA because is denied.

I remoted to the Windows 2003 sp1 server to use Active Directory Users and
Computer for change the User AAA's password but the same error message was
shown on the screen.

I visited the MS web site but there is no answer.

Please help me.

Thanks
Jimmy

"Jimmy" <hk2020@hotmail.com> wrote in message
news:%23HSWYPWGKHA.1248@TK2MSFTNGP04.phx.gbl...
> Hi, everyone
>
> Today I tried to change the user's password but the following error
> message was shown on the screen
>
> Windows Cannot complete the password change for User AAA because is
> denied.
>
> I remoted to the Windows 2003 sp1 server to use Active Directory Users and
> Computer for change the User AAA's password but the same error message was
> shown on the screen.
>
> I visited the MS web site but there is no answer.
>
> Please help me.
>
> Thanks
> Jimmy
>
>


We'll need additional information to help diagnose this. First thought is
it's a DNS configuration issue. But the first thing I would highly suggest
is to install Service Pack 2. SP2 has been out for the past 4 years. Kind of
surprised it has not been installed yet.

To help specifically diagnose the issue you are seeing, please post an
unedited ipconfig /all from the DC. If you have more than one, post one of
one of the others as well, too.

Also, please post any Event Log errors. Post the EventID# and Source Name.

Just an FYI, possible causes can include one or more of the following.

1. Using ISP's DNS, some external DNS, or the router as a DNS server in the
DCs and workstations.
2. AD is a single label name ('domain' vs minimal required form of
'domain.net').
3. Disjointed namespace.
4. DC is multihomed (more than one NIC and/or IP address, and/or RRAS is
installed on the DC).
5. SRV records in DNS zone are missing. A number of issues can cause this,
some of which I posted above. There are other causes, too.

It could be something simple, which is more than likely the issue, but this
info will help determine that and eliminate basic configuration settings
before we look further.

--
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Please reply back to the newsgroup or forum to benefit from collaboration
among responding engineers, and to help others benefit from your resolution.

Ace Fekay, MCT, MCTS Exchange, MCSE, MCSA 2003 & 2000, MCSA Messaging
Microsoft Certified Trainer

For urgent issues, please contact Microsoft PSS directly. Please check
http://support.microsoft.com for regional support phone numbers.

In addition to what Ace states (Howdy, Ace.....Football season is just
around the corner!!!!) I might suggest that you enable Auditing - if it is
not already enabled. This will at least pinpoint what the issue is so that
we do not have such a potentially wide gamut of options!

HTH,

Cary


"Jimmy" <hk2020@hotmail.com> wrote in message
news:%23HSWYPWGKHA.1248@TK2MSFTNGP04.phx.gbl...
> Hi, everyone
>
> Today I tried to change the user's password but the following error
> message was shown on the screen
>
> Windows Cannot complete the password change for User AAA because is
> denied.
>
> I remoted to the Windows 2003 sp1 server to use Active Directory Users and
> Computer for change the User AAA's password but the same error message was
> shown on the screen.
>
> I visited the MS web site but there is no answer.
>
> Please help me.
>
> Thanks
> Jimmy
>
>

Run diagnostics against your Active Directory domain.

If you don't have the support tools installed, install them from your server
install disk.
d:\support\tools\setup.exe

Run dcdiag, netdiag and repadmin in verbose mode.
-> DCDIAG /V /C /D /E /s:yourdcname > c:\dcdiag.log
-> netdiag.exe /v > c:\netdiag.log (On each dc)
-> repadmin.exe /showrepl dc* /verbose /all /intersite > c:\repl.txt
-> ntfrsutl ds your_dc_name > c:\sysvol.log
-> dnslint /ad /s "ip address of your dc"

**Note: Using the /E switch in dcdiag will run diagnostics against ALL dc's
in the forest. If you have significant numbers of DC's this test could
generate significant detail and take a long time. You also want to take into
account slow links to dc's will also add to the testing time.

If you download a gui script I wrote it should be simple to set and run
(DCDiag and NetDiag). It also has the option to run individual tests without
having to learn all the switch options. The details will be output in
notepad text files that pop up automagically.

The script is located on my website at
http://www.pbbergs.com/windows/downloads.htm

Just select both dcdiag and netdiag make sure verbose is set. (Leave the
default settings for dcdiag as set when selected)

When complete search for fail, error and warning messages.

Description and download for dnslint
http://support.microsoft.com/kb/321045


--
Paul Bergson
MVP - Directory Services
MCTS, MCT, MCSE, MCSA, Security+, BS CSci
2008, 2003, 2000 (Early Achiever), NT4
Microsoft's Thrive IT Pro of the Month - June 2009

http://www.pbbergs.com

Please no e-mails, any questions should be posted in the NewsGroup This
posting is provided "AS IS" with no warranties, and confers no rights.

"Jimmy" <hk2020@hotmail.com> wrote in message
news:%23HSWYPWGKHA.1248@TK2MSFTNGP04.phx.gbl...
> Hi, everyone
>
> Today I tried to change the user's password but the following error
> message was shown on the screen
>
> Windows Cannot complete the password change for User AAA because is
> denied.
>
> I remoted to the Windows 2003 sp1 server to use Active Directory Users and
> Computer for change the User AAA's password but the same error message was
> shown on the screen.
>
> I visited the MS web site but there is no answer.
>
> Please help me.
>
> Thanks
> Jimmy
>
>

"Cary Shultz" <cshultz@outsourceit.com> wrote in message
news:OjT%23yyaGKHA.1380@TK2MSFTNGP02.phx.gbl...
> In addition to what Ace states (Howdy, Ace.....Football season is just
> around the corner!!!!)

Yep! I watched some of the pre-season Buffalo/Tennesse game last night. Kind
of tough to get into the pre-season stuff. And now TO has another place to
vent his stuff (of course I have another word for that, but not here in the
groups!).

> I might suggest that you enable Auditing - if it is not already enabled.
> This will at least pinpoint what the issue is so that we do not have such
> a potentially wide gamut of options!
>

Auditing is a good idea, too! :-)

Ace