Frequently Asked Questions
Is Specops Password Reset compatible with Cisco VPN Client?
Yes, Cisco VPN Client Version 5 (possibly older versions too but untested) is compatible with Specops Password Reset.
“General access denied error” when trying to enroll for user accounts that are members of Domain Admins
The Specops service account doesn’t have permisson to update users that are members of the Domain Admins group. Access Control Lists on all security principals that are members of the built-in Administrators or Domain Admins groups are protected by the “AdminSDHolder Object”.
To allow the Specops service account to manage users that are members of the Domain Admins group follow the instructions described in “Method 2: Enable inheritance on the adminSDHolder container” in KB article http://support.microsoft.com/?id=817433.
At logon a balloon tip (in the notification area) is displayed informing users that they need to enroll for the Password Reset service, but when they click on the balloon the message “There is no enrollment policy configured for you” is shown
If “security filtering” is used to apply a Group Policy Object (GPO) to users, then the Specops Password Reset service account must be given read permissions to the GPO.
To grant the SPR service account read permissions to the Group Policy Object:
- Start GPMC
- Find and select the Group Policy Object
- Select the Delegation tab
- Press the Add… button
- Enter the name of the SPR service account
- Select Read permissions (default)
- Press OK
Page last modified on August 30, 2010, at 16:00 PM