This is a difficult post as it does not demonstrate a remedying process.
It merely demonstrates a stumbling block, we ran into as we tried to change an Active Directory Service Account’s password.
BTW, a couple of choices for changing an AD’s Account password are documented here.
Changing AD User Password : Attempting
Active Directory Users & Managers
Reset Password – Access is Denied
Tried to change password using dsmod
@echo off Rem Change a domain account’s password from the command line Rem https://itnsomnia.wordpress.com/2008/04/08/change-a-domain-accounts-password-from-the-command-line/ set "_SAMAccountName=SQLSvc" set "_ADPassword=antelopeWASBEFOREME#" echo ADUser dsquery user -samid %_SAMAccountName% dsquery user -samid %_SAMAccountName% | dsmod user -mustchpwd no -pwd %_ADPassword% Echo ERRORLEVEL is %ERRORLEVEL%
ADUser "CN=MSSQLsql,OU=ServiceAccounts,OU=LAB,DC=AD" dsmod failed:CN=MSSQLsql,OU=ServiceAccounts,OU=LAB,DC=AD:Access is denied.:Set password failed type dsmod /? for help. ERRORLEVEL is -2147467259 >
Active Directory Users And Computers
Per-using Active Directory Users and Computer, here is the AD Account’s setting:
- User must change password at next logon
- User cannot change change password
- Not Set
- Not Set
- Password never expires
From a simple User Property review, nothing should stop this Service Account from changing its own password.
In a follow-up post, will review whether restrictions have been set at the Organization (ou) level.