Server "User Must Logon..." Account Policy Denies Clients Access

• Microsoft Windows NT Server versions 3.5 and 3.51
• Microsoft Windows NT Server version 4.0
• Microsoft LAN Manager version 2.2c
• Microsoft Windows for Workgroups version 3.11
• Microsoft Network Client for MS-DOS version 3.0
• Microsoft Windows 95

SYMPTOMS

If the account policy "User Must Logon To Change Password" is checked in Windows NT 3.5 or 3.51, then Lan Manager 2.2c, Network Client for MS-DOS 3.0, Windows for Workgroup 3.11, and Windows 95 clients are unable to change their passwords. The policy is meant to keep users with expired accounts from being able to change their passwords. However, these clients receive Access Denied errors when they attempt to change their passwords, regardless of their account status. This does not happen to Windows NT 3.5 or 3.51 client computers.

CAUSE

The LAN Manager, Network Client for MS-DOS, Windows For Workgroups, and Windows 95 clients set an inappropriate flag when they request a password change on a Windows NT Server.

WORKAROUND

Turn off the "User Must Logon To Change Password" policy in User Manager on the Windows NT server.

STATUS

Microsoft has confirmed this to be a problem in Lan Manager 2.2c, Network Client for MS-DOS 3.0, Windows for Workgroups 3.11 and Windows 95. We are researching this problem and will post new information here in the Microsoft Knowledge Base as it becomes available.