Microsoft KB Archive/331834

= Change password functionality replaced with Active Server Pages =

Article ID: 331834

Article Last Modified on 1/22/2007

-

APPLIES TO


 * Microsoft Internet Information Services 5.0
 * Microsoft Internet Information Server 4.0

-



This article was previously published under Q331834



We strongly recommend that all users upgrade to Microsoft Internet Information Services (IIS) version 6.0 running on Microsoft Windows Server 2003. IIS 6.0 significantly increases Web infrastructure security. For more information about IIS security-related topics, visit the following Microsoft Web site:

http://www.microsoft.com/technet/security/prodtech/IIS.mspx



SUMMARY
With Internet Information Server (IIS) 4.0 and Internet Information Services (IIS) 5.0, the change password functionality is handled through an ISAPI extension, Ism.dll. This component has been removed from IIS versions 5.1 and 6.0, and the change password functionality has been modified to use Active Server Pages (ASP).



MORE INFORMATION
Note Users who are running IIS 5.0 together with Microsoft Windows 2000 Service Pack 4 (SP4) should follow the steps in Microsoft Knowledge Base article 831047. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

831047 FIX: You experience various problems when you use the Password Change pages in IIS 5.0

Users who are running IIS 6.0 together with Microsoft Windows Server 2003 Service Pack 2 (SP2) should follow the steps in Microsoft Knowledge Base article 833734. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

833734 FIX: You experience various problems when you use the Password Change pages in IIS 6.0

Using the Ism.dll ISAPI extension potentially exposes the Web server to more of a security risk because Ism.dll must be run under the security context of System. ASP, however, is run under the configurable security context of the current process (such as DLLHost, which uses the user, IWAM_, by default).

Using ASP technology also provides additional benefits, such as the ability to customize the change password functionality pages to include graphics or Web site designs.

This feature is available in the latest service pack for Windows 2000. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

260910 How to obtain the latest Windows 2000 service pack

A downloadable package has been created to deliver this ASP functionality for servers that are running IIS 5.0 on Microsoft Windows 2000 Server Service Pack 3 (SP3) or IIS 4.0 on Microsoft Windows NT 4.0 Server Service Pack 6a (SP6a).

Note This package has been tested and approved for use with Microsoft Exchange versions 5.5 and 2000 running Outlook Web Access (OWA). Because OWA references these files with an .htr extension, manually renaming the files breaks the OWA use of the change password functionality.

Windows 2000
To obtain and install this package, follow these steps:  Make sure that the Iisadmpwd virtual directory is present. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

269082 IISADMPWD virtual directory is not created during clean install of IIS 5.0

 To download the installation package for Windows 2000 Service Pack 2 or Windows 2000 Service Pack 3, visit the following Microsoft Web site:

http://microsoft.com/downloads/details.aspx?FamilyId=67D0D0F8-2978-4E7A-B079-346314BD2D5E&displaylang=en

 After you install the tool that converts the .htr pages to use ASP technology, update the .htr pages by using the hotfix packages that are described in the following article in the Microsoft Knowledge Base:

831047 FIX: You experience various problems when you use the Password Change pages in IIS 5.0

 In the Iisadmpwd folder, rename the Text.asp file as Text.htr.  In Notepad, open the Anot.htr file and the Anot3.htr file. Locate the following line of code.   In both files, change the line of code that you located in step 5 to the following line of code. </li> To configure these pages appropriately, follow the instructions that are described in the Microsoft Knowledge Base article in step 3.</li></ol>

Windows NT 4.0 SP6a
To download the installation package, visit the following Microsoft Web site:

http://microsoft.com/downloads/details.aspx?FamilyId=81CD9ED2-D1FF-425B-837D-A502EDE956FE&displaylang=en

Note The installation of this package requires that the ADSI client be installed on Windows NT 4.0. When you install the ADSI client for Windows NT, you may have to restart your computer.

To download the ADSI client for Windows NT 4.0, visit the following Microsoft Web site:

http://www.microsoft.com/ntworkstation/downloads/Other/adclient.asp

Additional details

The following table outlines the current implementations by IIS versions before you install this package:

The installation of this download, Ism2asp.exe, changes any use of Ism.dll in the table to Asp.dll. The file name extension, .htr, remains the same although the page itself is written with ASP technology and Microsoft Visual Basic Scripting Edition (VBScript).

<div class="references_section">