Workstations hang on "Change Password" after expired Password

Question

For one of our customers we have configered a maximum password age of 90 days. If those 90 days are over, the users are forced on logon to change their password. This worked fine for the past 9 months, but since today we have massiv problems.

The user gets notificated that he have to change his password. After changing it Windows shows the notification "Password beeing changed" and that is where the Problem occurs. In the past Windows showed after that the small text "Password has been changed" and starts to logon the user(loading his profile and so on). But since today there happens nothing. The Workstations are just hanging with the message "Password being changed" and the password circle is rotating.

If you turn off the workstation and logon again with the same User and the new Password, then you can logon. If you try to do this with the old password, you get an "Password and/or Username false" error. I was able to see this behavior on different workstations with different users. Because of that I suspect it is a network wide Problem.

So the password will be changed, but there is a Problem existing. What I've checked so far:

• EventViewer on the workstations (no errors/warnings)
• EventViewer on all DCs (no errors/warnings)

To be honest I have no idea why this is happening or were we should start searching the problem. Has anybody experienced something similar in the past ?

Environment: Workstation OS: Windows 8 Server OS: Windows Server 2012 (DC's) Server OS: Windows Server 2008R2 (Member)

Thanks

Solution

We had this problem at a previous employer. It was an ACL on the routers between the DCs and the workstations. Make sure that all required ports are available, especially 464 (as Mathias R. Jessen pointed out). Here's a list of those ports.

Comments

[Mathias R. Jessen]

Windows 7 and up uses the Kerberos Password Change service (kpasswd), accesible on port 464 on the Domain Controller - make sure that you don't have a firewall dropping traffic on that port in between

[YuKYuK]

Check ntp , check firewall , check windows files (chkdsk , scandisk etc) .