244 lines
4.2 KiB
Markdown
244 lines
4.2 KiB
Markdown
# IISADMPWD – Active Directory Password Change Portal for Modern Windows Server
|
||
|
||
This project restores the classic **IISADMPWD password change functionality** on modern Windows Server versions (2008/2012/2016/2019/2022+) and provides a slightly modernized UI.
|
||
|
||
It allows domain users to **change their Active Directory password through a web portal**.
|
||
|
||
Microsoft deprecated this feature after **IIS 6**, so it is no longer available in clean Windows Server installations. This repository provides the required files and instructions to restore the functionality.
|
||
|
||
## Features
|
||
|
||
- Active Directory password change via web UI
|
||
- Compatible with modern Windows Server versions
|
||
- Works behind reverse proxies such as Caddy, Nginx, and Traefik
|
||
- Updated UI with a more modern look
|
||
- Lightweight, with no external dependencies
|
||
- No visible internal IIS path required for end users
|
||
|
||
## Architecture Example
|
||
|
||
```text
|
||
User
|
||
│
|
||
▼
|
||
https://password.example.com
|
||
│
|
||
▼
|
||
Reverse Proxy (Caddy / Nginx / Traefik)
|
||
│
|
||
▼
|
||
IIS Server
|
||
/reset-password
|
||
```
|
||
|
||
External users only see:
|
||
|
||
```text
|
||
https://password.example.com
|
||
```
|
||
|
||
The internal IIS path remains hidden.
|
||
|
||
## Installation
|
||
|
||
### 1. Copy the files
|
||
|
||
Copy the repository contents to your IIS server:
|
||
|
||
```text
|
||
C:\inetpub\wwwroot\reset-password
|
||
```
|
||
|
||
The folder structure should look similar to:
|
||
|
||
```text
|
||
reset-password
|
||
├─ aexp2.htr
|
||
├─ aexp2b.htr
|
||
├─ aexp3.htr
|
||
├─ aexp4b.asp
|
||
├─ achg.asp
|
||
├─ achg.htr
|
||
├─ iisadmpwd.htr
|
||
└─ iispwchg.dll
|
||
```
|
||
|
||
### 2. Register the password change DLL
|
||
|
||
Open an **elevated command prompt** and run:
|
||
|
||
```cmd
|
||
regsvr32 C:\inetpub\wwwroot\reset-password\iispwchg.dll
|
||
```
|
||
|
||
You should receive a success message similar to:
|
||
|
||
```text
|
||
DllRegisterServer in iispwchg.dll succeeded
|
||
```
|
||
|
||
### 3. Enable password change functionality
|
||
|
||
Navigate to the IIS AdminScripts directory:
|
||
|
||
```cmd
|
||
cd C:\Inetpub\Adminscripts
|
||
```
|
||
|
||
Then run:
|
||
|
||
```cmd
|
||
cscript adsutil.vbs set w3svc/passwordchangeflags 0
|
||
```
|
||
|
||
#### PasswordChangeFlags values
|
||
|
||
| Value | Description |
|
||
|------:|-------------|
|
||
| 0 | Default – password changes enabled |
|
||
| 1 | Allow password changes without SSL |
|
||
| 2 | Disable password change |
|
||
| 4 | Disable password expiration notifications |
|
||
|
||
Recommended value:
|
||
|
||
```text
|
||
0
|
||
```
|
||
|
||
### 4. Enable Classic ASP
|
||
|
||
This application requires **Classic ASP**.
|
||
|
||
Install the feature using PowerShell:
|
||
|
||
```powershell
|
||
Install-WindowsFeature Web-ASP
|
||
```
|
||
|
||
Or via **Server Manager**:
|
||
|
||
```text
|
||
Web Server
|
||
→ Application Development
|
||
→ Classic ASP
|
||
```
|
||
|
||
### 5. Create the IIS application
|
||
|
||
Open **IIS Manager** and navigate to:
|
||
|
||
```text
|
||
Sites
|
||
→ Default Web Site
|
||
```
|
||
|
||
Right click **Default Web Site** and select **Add Application**.
|
||
|
||
Use the following values:
|
||
|
||
**Alias**
|
||
|
||
```text
|
||
reset-password
|
||
```
|
||
|
||
**Physical Path**
|
||
|
||
```text
|
||
C:\inetpub\wwwroot\reset-password
|
||
```
|
||
|
||
**Application Pool**
|
||
|
||
```text
|
||
DefaultAppPool
|
||
```
|
||
|
||
Click **OK**.
|
||
|
||
### 6. Restart IIS
|
||
|
||
```cmd
|
||
iisreset
|
||
```
|
||
|
||
## Local Test
|
||
|
||
Open one of the following URLs in your browser:
|
||
|
||
```text
|
||
http://SERVER/reset-password
|
||
```
|
||
|
||
or
|
||
|
||
```text
|
||
http://SERVER/reset-password/aexp4b.asp
|
||
```
|
||
|
||
## Reverse Proxy Example (Caddy)
|
||
|
||
This example exposes the portal at:
|
||
|
||
```text
|
||
https://password.example.com
|
||
```
|
||
|
||
while internally running under:
|
||
|
||
```text
|
||
/reset-password
|
||
```
|
||
|
||
Example Caddy configuration:
|
||
|
||
```caddy
|
||
password.example.com {
|
||
handle {
|
||
rewrite * /reset-password{uri}
|
||
|
||
reverse_proxy <ip-address>:80 {
|
||
header_up Host {host}
|
||
header_up X-Forwarded-Host {host}
|
||
header_up X-Forwarded-Proto https
|
||
header_up X-Forwarded-Port 443
|
||
header_up X-Forwarded-For {remote_host}
|
||
}
|
||
}
|
||
}
|
||
```
|
||
|
||
Users only access:
|
||
|
||
```text
|
||
https://password.example.com
|
||
```
|
||
|
||
## Security Notes
|
||
|
||
- Always place the portal behind **HTTPS**
|
||
- Prefer a reverse proxy with **TLS termination**
|
||
- Consider restricting access to **internal networks or VPN**
|
||
- Do not expose the portal publicly without proper access controls
|
||
|
||
## Supported Windows Versions
|
||
|
||
Tested with:
|
||
|
||
- Windows Server 2012
|
||
- Windows Server 2016
|
||
- Windows Server 2019
|
||
- Windows Server 2022
|
||
|
||
## Disclaimer
|
||
|
||
This project restores functionality from deprecated IIS components originally shipped with **Windows Server 2003**.
|
||
|
||
Use at your own risk.
|
||
|
||
## License
|
||
|
||
Provided as-is for educational and administrative purposes.
|
||
|