After CU14 update install on exchange 2019, users can not change the expired passwords

Hassan Waheed 5

After CU14 update install on exchange 2019, users can not change the expired passwords, Change password screen appears where you put the current and new passwords and then "something went wrong" appears. Please help

3 answers

Yuki Sun-MSFT 40,856 Reputation points

2024-03-01T03:04:49.2166667+00:00
Hi @Hassan Waheed ,

Please run the Exchange PowerShell below to check if there's an OWA mailbox policy applied to the affected user:

Get-CasMailbox <UserIdentity> | fl owamailboxpolicy

If the result shows there's no OWA mailbox policy applied, go to EAC > Servers > Virtual Directories > Features, make sure the checkbox of "Change password" is selected:

In case the above has already been checked but the issue remains, please go EAC > Permissions > Outlook Web App policies, select the policy you want to use, click features, make sure the checkbox of the "Change password" is selected:

Apply the owa mailbox policy to the affected user:

Set-CASMailbox -Identity <UserIdentity> -OwaMailboxPolicy <MailboxPolicyIdParameter>

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.
Hassan Waheed 5 Reputation points

2024-03-01T05:55:28.7433333+00:00

Thanks Yuri for your help.
I have checked this already, all the permissions are set,

Still getting the same issue.

Yuki Sun-MSFT 40,856 Reputation points

2024-03-01T06:17:28.1+00:00

Hi @Hassan Waheed ,

Have you had a chance to try creating a new OWA mailbox policy with the necessary features and then assign it to one affected user to see how it goes?

By the way, how about resetting the password on a domain joined machine by hitting "Ctrl+Alt+Delete"?

Hassan Waheed 5 Reputation points

2024-03-01T06:21:28.5733333+00:00

Well Yuri, the issue is for all the users, not just 1 or 2.

secondly, We are running multiple domains, so machines are on different domains.
Plus, when i reset the password from AD, and check "change password on the nest logon" then there is an issue with the password reset. when i check the "password never expire" then there is no issue.
this is just for the expired password.
if my password is not expired and i change the password from OWA, it works fine too.

Yuki Sun-MSFT 40,856 Reputation points

2024-03-01T07:12:04.39+00:00

Hi @Hassan Waheed ,

Thanks for the clarification.

if my password is not expired and i change the password from OWA, it works fine too.

I do understand that the issue appears right after installing CU14, but from these symptoms, this doesn't seem to be an issue concerning the "Change Password" permission in either the OWA virtual directory or the OWA mailbox policy, otherwise the users would be unable to change password in any situations.

And considering that you also have issue when checking "change password on the nest logon" in AD, it appears to me that it's more likely to be an issue related to AD. As aforementioned, can the affected user change expired password when logging on domain-joined machine? If it fails either, I'd recommend checking the password policies in AD and see if there are any findings.

Hassan Waheed 5 Reputation points

2024-03-01T18:36:03.1+00:00

will do that and post results here

Yuki Sun-MSFT 40,856 Reputation points

2024-03-04T09:02:55.5666667+00:00

Hi @Hassan Waheed ,

Just checking in to see how things are going on with this issue. Is there anything you'd like to update? By the way, if you are in the RDP environment, you might be interested to check thread below which discusses an issue occurred in RDP environment that users cannot change expired password: https://learn.microsoft.com/en-us/answers/questions/1013756/windows-2019-rdp-user-cannot-change-expired-passwo

In case you still need further assistance in terms of the password policies in AD, I'd recommend trying to start a new thread using some Windows Server or Active Directory tags so that community users who are more familiar with AD could be able to look into the issue as well.

Hassan Waheed 5 Reputation points

2024-03-05T06:49:13.6+00:00

So here is the update, I have put all my user's passwords to "Never Expire". and I have tested using a laptop in the domain, and tried to reset the expired password by Dell+Alt+Ctrl, and guess what, I was able to change the password, I tried resetting the expired password on OWA, same issue, no luck.

This is very interesting.

Yuki Sun-MSFT 40,856 Reputation points

2024-03-07T01:44:04.1333333+00:00

Hi @Hassan Waheed ,

Thanks for the update. It's indeed weird. Just wondering was there any other change aside from installing Exchange CU14 occurred right before the issue? And are your users using RDP?

Hassan Waheed 5 Reputation points

2024-03-07T07:02:04.6666667+00:00

Just CU14, I only RDP into servers, users connect via outlook or OWA.

Yuki Sun-MSFT 40,856 Reputation points

2024-03-08T07:57:58.05+00:00

Hi @Hassan Waheed ,
Sorry that I am not a Windows server expert and my knowledge about RDP is limited. But based on my research, have you tried checking the Security Layer setting and see if it's configured as "RDP Security Layer"? If not yet, I assume it's worth trying to change this setting and see if there would be any difference.
Windows Server 2016 RDP–You must change your password before logging on the first time
Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.
Sign in to comment
Jaroslav Mixa 0 Reputation points

2024-03-28T13:05:23.01+00:00

We have the same issue.

We have a hybrid environment and some users cannot log in or change passwords using OWA. The login window appears again and again.

It seems it happens mainly to external users outside of the domain.

We cleared the browser cache, saved passwords, and tried an incognito window. We tested Chrome and Firefox.

It started after the last exchange upgrade.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment
Yuki Sun-MSFT 40,856 Reputation points

2024-04-01T05:42:28.5733333+00:00

Hi @Hassan Waheed and @Jaroslav Mixa ,

Just wondering are you in a multi-forest topology? If so, please go through the article below and make sure the setting override mentioned there has been configured.
Users in account forest can’t change expired password in OWA in multi-forest Exchange deployments after installing August 2023 SU
Please sign in to rate this answer.

0 comments No comments
Sign in to comment