Error: The user was not found

[rchandan]

Hi Ryan,

Thank you for this wonderful piece of functionality.
During our testing we found one issue, as described below,

Our MIM environment is configured to manage Users from multiple domains belonging to same forest. We are able to reset the password for Users accounts from the same domain as of the Helpdesk user who has logged into MIM portal. For eg., if the Helpdesk user who has logged into MIM belongs to Domain1 then he will be able to Successfully Reset password for Users from Domain1 only. If he tries to Reset password from Domain2 then it gives error "The user was not found". To Reset password for Domain2 users he needs to Re-login with his Domain2 Credentials and then he is able to Reset password for Domain2 Users. Password Reset Permissions are given for a Group on all the Domains and Helpdesk users are given membership to the Group.

Can you please let us know.

[ryannewington]

@rchandan I've added a new parameter to the configuration file to allow you to specify the name of the global catalog server and its port. I don't have a multi-domain forest to test with, do you might need to help me with some logging if this doesn't work.

Use the new domainController attribute to specify the name of a GC domain controller, and the GC port (3268)

<lithnetAssistedPasswordReset domainController="dc.domain.com:3268"
                              allowSpecifiedPasswords="true" 
... />

See this page for instructions on setting up the configuration file

Here's the test build

https://github.com/lithnet/resourcemanagement-ui-assistedpasswordreset/wiki/Configuration-file-reference
assisted-password-reset.zip

If it doesn't work can you capture some debug logs by running this
http://technet.microsoft.com/en-us/sysinternals/bb896647.aspx
selecting "Capture Global Win32" from the capture menu, and then trying to reset a password?

[rchandan]

Hi Ryan,

Thanks for the response.

I will surely try and let you know. But would need sometime as I am bit held up with other activities. Will keep you posted.

[ryannewington]

I'm trying a new approach that involves calling the sync engines WMI methods to reset passwords. This is the same approach that the SSPR module uses, so if SSPR works, then this should work as well.

This is VERY beta at the moment, really just to see if it works around all multi-domain/forest scenarios.

assisted-password-reset.zip

You will need to modify the "C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\TEMPLATE\LAYOUTS\web.config" file and add the following blocks in

<configSections>
    <section name="lithnetAssistedPasswordReset"
      type="Lithnet.ResourceManagement.UI.AssistedPasswordReset.AppConfigurationSection, Lithnet.ResourceManagement.UI.AssistedPasswordReset"/>
</configSections>

<lithnetAssistedPasswordReset syncServer="fimsync"/>

Replace 'fimsync' with the hostname of your sync server.

The user's resetting passwords need to have permission to read the 'Domain' and 'AccountName' attributes from the MIM Service. They will also need, as a minimum, membership in the FIMSyncPasswordSet group. This version of the module does not call into AD directly anymore, so it does not require any AD permissions be set.

[rchandan]

Hi Ryan, Thanks for the Update. We currently have some issues with our Dev environment and we are trying to fix the same. Need sometime to test this new approach. Will keep you posted once I have tried from my end. Meanwhile please let me know once you have any more update regarding new approach. Regards, Chandan

…

On Fri, Dec 15, 2017 at 9:23 AM, Ryan Newington ***@***.***> wrote: I'm trying a new approach that involves calling the sync engines WMI methods to reset passwords. This is the same approach that the SSPR module uses, so if SSPR works, then this should work as well. This is VERY beta at the moment, really just to see if it works around all multi-domain/forest scenarios. assisted-password-reset.zip <https://github.com/lithnet/resourcemanagement-ui-assistedpasswordreset/files/1561510/assisted-password-reset.zip> You will need to modify the "C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\TEMPLATE\LAYOUTS\web.config" file and add the following blocks in <configSections> <section name="lithnetAssistedPasswordReset" type="Lithnet.ResourceManagement.UI.AssistedPasswordReset.AppConfigurationSection, Lithnet.ResourceManagement.UI.AssistedPasswordReset"/> </configSections> <lithnetAssistedPasswordReset syncServer="fimsync"/> Replace 'fimsync' with the hostname of your sync server. The user's resetting passwords need to have permission to read the 'Domain' and 'AccountName' attributes from the MIM Service. They will also need, as a minimum, membership in the FIMSyncPasswordSet group. This version of the module does not call into AD directly anymore, so it does not require any AD permissions be set. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#8 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AeYE4s_qBVulkTNk8bAC1hCowtFTbHNNks5tAe0vgaJpZM4Qj59T> .

-- Regards, Chandan R

[ryannewington]

@rchandan Did you have a chance to test this build?

[rchandan]

Hi Ryan, I am out of the project. But there is another team which is working on the same project, will check with them and let you know. Regards, Chandan

…

On Tue, Mar 6, 2018 at 3:43 AM, Ryan Newington ***@***.***> wrote: @rchandan <https://github.com/rchandan> Did you have a chance to test this build? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#8 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AeYE4pRLHasLBwy4C4r2Q8rEtWVmoHGUks5tbbhhgaJpZM4Qj59T> .

-- Regards, Chandan R

[RobinBeismann]

Hi Ryan,

do you have any plans to port the WMI Approach to the main branch?
Sounds like a way better method to me, as this scales with the MIM Deployment complexity.

Best regards
Robin

[ryannewington]

@RobinBeismann yes, that's the plan, but I haven't had a chance to test it thoroughly yet. Happy to work with you if you have a use case for testing this in your environment.

[RobinBeismann]

Hi Ryan,

yeah - I'd have a usecase for that, however I'll set up my test environment somewhen next week, after that I'm open for tests on that system.

Thanks!

[ryannewington]

@RobinBeismann great! Let me know when you are ready to go. The code is in the current build that's on the releases page, we just need to manually activate it and set some appropriate settings. We'll document the process as we go, so we can add it to the wiki pages.

[ngone]

Hello,
Is it possible to know the detailed rights that a Domain User needs to have to be able to perform et password reset ?
Thanks.

[ryannewington]

@ngone you can use this guide https://www.petri.com/delegate-permission-reset-ad-user-account-passwords