Article ID: 937011
Article Last Modified on 10/25/2007
APPLIES TO
- Microsoft Exchange Server 2003 Standard Edition
- Microsoft Exchange Server 2003 Enterprise Edition
Important This article contains information about how to modify the registry. Make sure that you back up the registry before you modify it. Make sure that you know how to restore the registry if a problem occurs. For more information about how to back up, restore, and modify the registry, click the following article number to view the article in the Microsoft Knowledge Base:
256986 Description of the Microsoft Windows registry
SYMPTOMS
Consider the following scenario:
- You configure the option that lets you use Microsoft Office Outlook Web Access for Exchange Server 2003 to change domain passwords.
- Password expiration messages appear as expected in Outlook Web Access.
Note The password expiration messages appear as yellow a banner in the upper part of the details pane in Outlook Web Access. These messages resemble the following:
After you apply updates to Exchange, the password expiration message may no longer appear for Outlook Web Access users. You may experience this problem after you apply one of the following updates:
924334 The Compose Message form stops responding after you install Internet Explorer 7.0 and the S/MIME control on an Outlook Web Access client in Exchange Server 2003
926666 Update for daylight saving time changes in 2007 for Exchange 2003 Service Pack 2
Note This problem may also occur after you apply any update that updates the Davex.dll file to version 6.5.7651.60 or to a later version.
CAUSE
This problem occurs for the following two reasons:
- The pwdLastSet attribute is not a member of the Lightweight Directory Access Protocol (LDAP) partial set.
- The pwdLastSet attribute is included in the cacheable attributes collection of naming context-based objects.
If the first request to the user object uses the global catalog, the pwdLastSet attribute is cached in DSACCESS together with a value of Not set. Therefore, when the Davex component retrieves the value of the pwdLastSet attribute, the following behavior occurs:
- If the DSACCESS component has an unexpired cached value, the cached value is returned in the LDAP query.
- If the cached value is Not set, the LDAP query returns a value of zero to Davex.
- If the value is zero, Davex does not display the password notification message to the user in Outlook Web Access.
WORKAROUND
To work around this problem, perform both of the following actions:
- Add the pwdLastSet attribute to the LDAP partial set of the global catalog on the schema master.
- Configure the pwdLastSet attribute to replicate to the global catalog.
To do this, follow these steps.
Step 1: Enable updates to the Active Directory directory service schema
Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall the operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.
Set the Schema Update Allowed registry entry to let the schema administrator modify the schema. To do this, follow these steps:
- Click Start, click Run, type regedit, and then click OK.
- Locate and then click the following registry subkey:
HKEY LOCAL MACHINE\System\CurrentControlSet\Services\NTDS\Parameters - In the details pane, right-click Schema Update Allowed, and then click Modify.
- In the Value data box, type 1 (one), and then click OK.
- Exit Registry Editor.
Step 2: Set the "isMemberOfPartialAttributeSet" attribute value to TRUE
Warning If you use the ADSI Edit snap-in, the LDP utility, or any other LDAP version 3 client, and you incorrectly modify the attributes of Active Directory objects, you can cause serious problems. These problems may require you to reinstall Microsoft Windows 2000 Server, Microsoft Windows Server 2003, Microsoft Exchange 2000 Server, Microsoft Exchange Server 2003, or both Windows and Exchange. Microsoft cannot guarantee that problems that occur if you incorrectly modify Active Directory object attributes can be solved. Modify these attributes at your own risk.
To add the pwdLastSet attribute to the LDAP partial set of the global catalog, you must set the isMemberOfPartialAttributeSet attribute value to TRUE on the schema master. After you set the isMemberOfPartialAttributeSet attribute, you must give enough time for the Active Directory directory service to replicate the change among the domain controllers in the domain.
To set the isMemberOfPartialAttributeSet attribute to TRUE, follow these steps:
- Start the ADSI Edit tool. To do this, click Start, click Run, type adsiedit.msc, and then click OK.
Note The ADSI Edit tool is included with the Windows Support Tools. To install the Windows Support Tools, double-click Supptools.msi in the Support\Tools folder on the Windows Server 2003 CD. - Expand Schema [
domainController.example.com, and then click CN=Schema,CN=Configuration,DC=example,DC=com. - In the details pane, right-click CN=Pwd-Last-Set, and then click Properties.
- In the CN=Pwd-Last-Set Properties dialog box, click isMemberOfPartialAttributeSet, and then click Edit.
- In the Boolean Attribute Editor dialog box, click True, and then click OK.
- Click Apply, click OK, and then exit the ADSI Edit tool.
- Give enough time for the changes to replicate among the domain controllers in Active Directory. For more information about how to force replication to occur in Active Directory, visit the following Microsoft Web site:
Step 3: Register the Schmmgmt.dll file
To configure the pwdLastSet attribute to replicate to the global catalog, you must use the Active Directory Schema stand-alone Microsoft Management Console (MMC) snap-in. By default, this snap-in does not appear in the Available Standalone Snap-ins list in Microsoft Windows Server 2003. For this snap-in to appear, you must register the Schmmgmt.dll file.
To do this, follow these steps:
- Click Start, click Run, type regsvr32 c:\windows\system32\schmmgmt.dll, and then click OK.
Note If Windows is installed on a drive other than drive C or if Windows is installed in a folder other than the Windows folder, modify this path as appropriate. - If you receive the following message, click OK:
Step 4: Replicate the "pwdLastSet" attribute value to the global catalog
Configure the pwdLastSet attribute to replicate to the global catalog. To do this, follow these steps:
- Click Start, click Run, type mmc, and then click OK.
- On the File menu, click Add/Remove Snap-in.
- Click Add, click Active Directory Schema, and then click Add.
- Click Close, and then click OK.
- In the Console1 MMC snap-in, expand Active Directory Schema, and then click Attributes.
- In the details pane, locate and then double-click pwdLastSet.
- In the pwdLastSet Properties dialog box, click to select the Replicate this attribute to the Global Catalog check box, and then click OK.
Step 5: Turn off schema updates
Set the Schema Update Allowed registry entry to 0 (zero) to turn off schema updates. To do this, follow the procedure that is listed in the "Step 1: Enable updates to the Active Directory directory service schema" section.
Note In step 4 of this procedure, do not type 0 (zero) in the Value data box. Instead, type 1 (one), and then click OK.
Step 6: Restart the domain controller
Sometimes, you must restart the domain controller to apply the changes. If the Outlook Web Access password expiration message does not appear, restart the domain controller.
STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.
MORE INFORMATION
For more information, click the following article numbers to view the articles in the Microsoft Knowledge Base:
248717 How to modify attributes that replicate to the global catalog
216060 Registry modification required to allow write operations to schema
232517 Global catalog attributes and replication properties
For more information about how to obtain the Microsoft Exchange Server Outlook Web Access Web Administration tool, visit the following Microsoft Web site:
Additional query words: OWA, iispwd, expiry notification
Keywords: kbenv kbnofix kbbug kbeventlog kbtshoot kbprb KB937011
