Booches.nl

Active Directory: one account, two passwords

Lately I noticed something strange. I configured an ISA server as reverse proxy for OWA. The customer demanded the ability for users to change their password through OWA. I configured the OWA listener with LDAPS authentication against the Active Directory and enabled the option to select “I want to change my password after logging on” like shown below.

I tested the environment by logging in and changing the password. Everything looks okay and the password is changed correctly. I tried some extra test. I opened another browser and tried to login with the old password, which succeeded. I could now login with the old and the new password.

Strange to me…..so I tried some more test. The customer is using an SSL portal with RADIUS authentication to the same Active Director. So I tried to log in with the old and new password. I guess you know the answer. It was possible to login with both password. Another test was login in to the network components, which also use RADIUS against the Active Directory. Again the test were positive.

The last test was login in on a workstation. With this test, I could only login in with the new password and not the old one. Strange to me…… After one hour I tried again, and this time it was only possible to login with the new password.

I guess there is some kind of period where you can use both password. Maybe someone noticed this before and knows more about it…

René Jorissen works as Solution Specialist for 4IP in the Netherlands. Network Infrastructures are the primary focus. René works with equipment of multiple vendors, like Cisco, HP Networking, Juniper Networks, RSA, PaloAlto Networks, Microsoft and many more. René is CCNA (Routing & Switching, Security), CCNP , Cisco ASA Specialist and CEFFS certified. You can follow René on Twitter and LinkedIn.

René Jorissen

View all posts by René Jorissen
Company website

Related Articles

• Exchange 2007 with ISA 2006
• Where is the Internet Authentication Service?
• Microsoft ISA publishing – it’s all in the “path”
• Automatic Log In Reverse Proxy with FBA
• PDA Active Sync – Invalid Certificate
• LDAP and eSafe Gateway
• Cisco ASA – Full recovery
• ISA Server 2006 array – renew certificate
• Restore RSA 7.1 primary database and RADIUS config
• VMware: upgrade VMware Tools and Virtual Hardware for Microsoft ISA array