windowswindows-server-2012-r2
I got the following message trying to RDP to a Windows Server 2012 R2. However I can't get a prompt or anything to change the password. Is this due to NLA (network-level authentication) or could it be something else?
This user account's password has expired. The password must change in
order to logon. Please update the password or contact your system
administrator or technical support.
Taken from here.
It is possible to enable or disable "First Sign-in Animation" in Group Policy Editor:
Type WinKey + R, and press Enter. Enter gpedit.msc and press Enter.
If prompted by UAC, then click/tap on Yes.
In the left pane, click/tap on to expand Computer Configuration, Administrative Templates, System, and open Logon.
In the right pane of Logon, double click/tap on Show first sign-in animation.
To Enable "First Sign-in Animation", select Enabled.
Force a Group Policy Update by opening 'Run' again and executing gpupdate.exe /force.
Please note that you may not have these features natively in Server 2008 and will need to import these settings into your GPMC. Get these here.
You can solve this with a two pronged approach:
The following directions are from the woshub.com article Allow users to reset expired password via RD WebAccess in Windows Server 2012:
In Windows 2012 / 2012 R2 an option appeared that allows a remote user to change their password (current or an expired one) using a special web-page on the RD Web Access server. The password will be changed like this: a user signs in to the registration web page on the server with the RD Web Access role and changes his password using a special form.
A remote password change option is available on the server with the Remote Desktop Web Access (RD Web Access) role, but it is disabled by default. To change a password, a script password.aspx is used, which is located in C:\Windows\Web\RDWeb\Pages\en-US.
To enable the password change option, on the server with the configured RD Web Access role open the IIS Manager console, go to [Server Name] –> Sites –> Default Web Site –> RDWeb –> Pages and open the section Application Settings.
In the right pane, find PasswordChangeEnabled parameter and change its value to true.
You can test the password change mechanism going to the following web-page:
https://RDSServerName/RDWeb/Pages/en-US/password.aspx
Now when trying to connect to the RD Web Access server with the expired password, a user will be redirected to password.aspx web-page and offered to change his password.
Tip. The same Windows Server 2008 R2 feature can become available after you install a special patch — KB2648402.
gpedit.msc on the RDSH server to open Local Group PolicyComputer Configuration\Windows Settings\Local Policies\Security Options
Best Answer
I was able to get the password changed after I added this row:
temporarily to my default.rdp file
c:\users\[username]\documents. This changed the situation so that the authentication happened in server side, and the the server was able to show the dialog for giving the new password.