关于OWA中密码过期提醒

钉子

关于这个问题MVP Yang Xun有一个BLOG说明，请看：

转自：http://xunyangit.spaces.live.com/blog/cns!F934535AFC3723BA!2487.entry

owa的用户密码修改的功能在iis6中，是通过IISI中提供的IISADMPWD提供的。虽然通常情况下，用户密码过期后是无法登陆owa的，但是实际上owa的密码修改功能是可以满足下列情景的需求：

• To change their password after they have logged on to their mailbox by using Outlook Web Access
• To change their password if their password will expire within a given time period
• To change their password if their password has already expired
• To change their password if the User must change password at first logon is enabled
• To change their password if the User cannot change password option is enabled

这里我们主要是满足前4项的需求。需要去修改iis的一项属性passwordchangeflags。默认iis的该属性赋值为6，你可以通过下面的命令获取当前状态：

为了满足需求，执行下面的脚本

具体这些值的意义见下表

Value	Setting
0	An SSL connection is required to change passwords
1	An SSL connection is not required to change passwords
2	Password changing is disabled
4	Password expiration notification is disabled
6	Password changing and password expiration notification are disabled

用户在下次登录必须修改密码的状态下，依然可以使用旧密码登录。如果这次登陆没有修改密码，那么注销后将依然可以旧密码登陆。登录后会有如下提示： 修改密码后，可能会因为ad复制的关系，导致对勾未取消。等待一段时间以新密码登录即可正确取消该对勾。 [url=https://cxuyjq.blu.livefilestore.com/y1m3Qgwz5ClYjWfWmcA67i-jK-l4k9aJv6sO688HUMg8WcDg1DhK5cfJMhIz9We_UyGaLDCFKd6utelDhIqF5n5RC91uyfsjtsGyLy7oY3zf4nA7W_gYILEvg764zVoAw1EcRz6-L3jQ_FlUyyXMSsD3Q/clip_image002[2].jpg][img=210,50]https://cxuyjq.blu.livefilestore.com/y1mslOl7pT7PNO_IF0rFuupzcOcC4Xd65Pokbqwpvrd_r3xWxTfICMiv1e7BWE2Rv9ZpymjP-a0w8jEvIFwq2mI9HxD_M6TvfMg1cSV7u26ovXReZ1nGTW28VD_TGHTvteAfzY3NId4atwF5-1hGIXk7w/clip_image002_thumb[1].jpg[/img][/url]
补记：
针对exchange 2003或者exchange 2000，你可以修改注册表来实现类似的功能：

• 在cas上启用IISADMPWD功能，在之前的文章有具体做法，我就不放了。
• 每个后端 Exchange 2003/2000 上在HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSExchangeWeb\OWA下创建
  type:   DWORD Value
  name:  DisablePassword
  value:  0
• 在cas上修改inetmgr的 Web Service Extensions中Allow功能Active Server Pages

【update】让用户在登录到邮箱之前就必须修改密码
1、执行命令 cscript.exe adsutil.vbs set w3svc/passwordchangeflags 0 [url=https://cxuyjq.blu.livefilestore.com/y1mmn6xejO2pcUqCSi1_JHH-UOWfVHUVkaeRXSAiy0IspUMWf_oLpYxv1szLpZxGVCRBf3M_4nVB_F4TRDkRhoUglzdxiIOsGI3pHZsBEzXqfqt5LOCY13cOmOJNUVOg_lkRI3S-LBmzEOuxLTRysgT7w/clip_image001[1][2].png][img=607,98]https://cxuyjq.blu.livefilestore.com/y1mURyWpfU-N1RNWU4dPdlM1PnzTssXf7pazbBxWal9wjXg-xnn95WXc3v9WMwIRMfPSKOrodcuBqG_zXTvdbK3OxkPHMQS_W8zMj1WkwUO0BT3ZgR6n5Mlt5SHO54oamLz4uNBUNwR-Tdgr0zk4NRlwA/clip_image001[1]_thumb.png[/img][/url] [url=https://cxuyjq.blu.livefilestore.com/y1mVQDdV4MBkrk0phKp5UGaOkork5zl7j0KPpYDH1USdNdGkaeCCttpO5gQ3IJ_kIa822wr-P5HAkP3IIvL9dnl-KsldJ-XXGze6QZJtqMLOpKB54ZfHMYplD226dLoSgyBiaFpiy9SWO6-PXUKuNOUcA/clip_image002[1][2]%200EA83740.png][img=630,112]https://cxuyjq.blu.livefilestore.com/y1mjJnxsVEuy81DDkccOYeenc2RhmVMy_PPpvMlkVcP3jNsmwvZpCTG49iFAIDp7ZJbbgwNPfxJSkL3Ws-X6YiAyW0pkmWJGlMMgKEvsvt8b79qtmh49KcAR9PxLnJH6w-ajg2QklCZ5oIlZEAymL_fsA/clip_image002[1]_thumb.png[/img][/url] 2、inetmgr中修改 2.1 扩展 [url=https://cxuyjq.blu.livefilestore.com/y1mqPVKkO3IoZGRF_8QustN90jRSNgBvRmeR-EbRICStppphdjY_gaWdrZOFM52nZZtWHairbPPq_eS-6QTs2mtyKs412eF2CChSw3mSWmrCVL3bk-h4Mx1kGF8L9RBIGLmfbTbDKo2ttxfXG2-2iB0qQ/clip_image003[3]%20210C73F6.png][/url]

• 创建IIS虚拟目录
• [url=https://cxuyjq.blu.livefilestore.com/y1mkFY9zzkoJW5CdaAIRFa_nEifRNKUx9egoBujj45l5zogOsjh09RkqqZYtXJC1syVNfcm08qE-33nbEYPh2u3NDHdUkhmWHco-Ns4yFMUicD_OyGV3FmbtAQjJtx5PGlwbZhehvmeB4xZ9qT58mYGEA/clip_image004[3]%20341966D6.png][/url]

• [url=https://cxuyjq.blu.livefilestore.com/y1mqxRl1KmOED4wHZ4pwmEVhL07Wk6XX8XZXxyo2N4o6DZSaUKTbKuaSww-O5OkYKyCSy3c8hnt3J-K43eJroS20GNy3KRzvhzuAzNWCjjAYIuFbUelkdSmfp0t6lUuo2yRCHVVZu_b4KoeSkGzNg1xQw/clip_image005[3]%200A41B217.png][/url]

• [url=https://cxuyjq.blu.livefilestore.com/y1mKA7Fs6lVTtwyRZEX_3ARGrZGxowvCpo7jbdRTF0o5_c8_8SPmIB_BWCRXaX8l3KALthCoqDqu7hoiY0tty1K2eULlfKut4yG_uZXPKYTq6VhY-djQF2pznNwurH8jqG6dlpmDNbtreoTQj_ZBsaZow/clip_image006[3]%2047121FEA.png][/url]

• [url=https://cxuyjq.blu.livefilestore.com/y1mXCn1jSHp4fEt67kUuAEpTTYBsERu9mppleoIaXpnDC8v_xxSNUsRN012X7_j9WwsiRHdAN8bXD7uYtDHxepXYXx20DxXhl6Rk14JspxIChQ3lbYtfEg89v8VLB955pN_WHKVRmrftzuijWz-bEBqDA/clip_image007[3]%2051DAC766.png][/url]
• 修改虚拟目录属性
• [url=https://cxuyjq.blu.livefilestore.com/y1mhcaJN82h0du4Ny4ABysxUXjVtMy6Sirnt0pudjshWw3e3NOu8cqzvcP52UnI9CoXQ8__u9V6MhTqZUNs9XpyXT_ttPtiOHxmiwpx4hL92K6Ly8yBWPdmkzyM288f5ikQjpxTi3ADlkmq-bhBqw5SJw/clip_image008[3]%202310FAC5.png][/url]
• 确认application pool为MSExchangeOWAAppPool
• [url=https://cxuyjq.blu.livefilestore.com/y1m8jssfhdCfYMsiumUZ-q0-WU5ccKHrPYNQUGjgfdrRMHpjizojp1_wW0L5KwFBejerB_1CQovaIild2pgobyC0ZrCEenVTWnP79y44JhOob2CFs0w6RCnrxysKEMHG2czlyyXNMUx3IxX1Lz9n2K7fg/clip_image009[3]%202575CCEA.png][/url]
• 确认匿名访问启用
• [url=https://cxuyjq.blu.livefilestore.com/y1m-v5OD1XmMKgw5pZ3DBL6qmdVqpufMu0SMbVemvrcOHd8km5GvyqtFHASiDRulHl2235V40v2WXRFJjB4Jw76h5Poqq_7G1deVc4pAxmvYLNA9lwTKug3LXRRFppl-e-vFAi3m1aDJ5xkLnyN38QiGA/clip_image010[3]%202C149CA1.png][/url]
• 执行命令regsvr32 c:\windows\system32\inetsrv\iisadmpwd\iispwchg.dll

额外可以去检测下列值是否正确。

Value	command
0	cscript.exe adsutil.vbs get w3svc/passwordchangeflags
/iisadmpwd/achg.asp	cscript.exe adsutil.vbs get w3svc/AuthChangeURL
/iisadmpwd/aexp.asp	cscript.exe adsutil.vbs get w3svc/AuthExpiredURL
/iisadmpwd/aexp3.asp	cscript.exe adsutil.vbs get w3svc/AuthExpiredUnsecureURL
/iisadmpwd/anot.asp	cscript.exe adsutil.vbs get w3svc/AuthNotifyPwdExpURL
/iisadmpwd/anot3.asp	cscript.exe adsutil.vbs get w3svc/AuthNotifyPwdExpUnsecureURL
N/A	cscript.exe adsutil.vbs get w3svc/PasswordExpirePreNotifyDays

              实际使用情况状态当密码过期登录账户登录owa后，会直接跳转到密码修改页面 [url=https://cxuyjq.blu.livefilestore.com/y1mF93uzUxwFv4LDBwJ0nA_ol2YoB10NZeQQ6S5-93PLSlzP3sUHiT2IjW92v0G5vwWGm53wU-uLGoYuHKKlmk1FWw64qQjKe89SuGT3QNoCSaRCnXqcQzlLUUOdjeKfJwEn5t10vkM4I_65rUrRZE8Cg/clip_image011[3]%20317EF946.png][/url] 注意此时修改密码的账户需要使用upn或者sam账户全名 [url=https://cxuyjq.blu.livefilestore.com/y1mIW5I3zmIkUopJGtpdFJ1hQcb1TqJLGKOqtuoSSq7fhRVGUdaYZf9wMs171_gv7Sq2DnD0xc7ieqnxfIfdAe8Lfn7HdKDC90pTpv26VRXdc6cJKqq3jSvI_QrHEh5SlI3y7XFmnXg12oXaOLoiHBmuw/clip_image012[3]%2015E5BD77.png][/url] 密码修改成功后会返回下面的页面 [url=https://cxuyjq.blu.livefilestore.com/y1mccM2SuZ6IVg-ZnTfTfC52VP0b9Rrt7H_GKXIZs_PWbpr_XX6UdkOxFexUPxjdp5dBeHH00MaNzygdp1aHQ-ddlFCYLDTAKuhczrrL3Usqvr-eJb-KSGguD1k-saAoFu_qlmvR_Q1VJPhjg4kE-ywLQ/clip_image013[3]%201F4A4221.png][/url] 点击owa连接后，会返回owa的fba页面，其下端会报登录失败的提示，可以忽略。 [url=https://cxuyjq.blu.livefilestore.com/y1mTjratr_TbwCvy_wcT1LUOCHK5jK3ZxO2tvzQlxod5hCdbpMbwFQLgC_k5XfPkkhNKcKVdo69DjL9SgThgFJdSU2oSUc-RLoljr8NAvcTviggtqpYn_dvFWLNrYtbyb18jwJqxAuW6mmIlvruL0DTCQ/clip_image014[3].png][/url] 以上已经可以满足需求。但是建议修改页面的美观度，并添加相应的密码策略提示。

pater

真的很用心啊。。。感謝！