Unable to change password using the IIS 4.0 change password feature (184058)

We strongly recommend that all users upgrade to Microsoft Internet Information Services (IIS) version 6.0 running on Microsoft Windows Server 2003. IIS 6.0 significantly increases Web infrastructure security. For more information about IIS security-related topics, visit the following Microsoft Web site:

http://www.microsoft.com/technet/security/prodtech/IIS.mspx

SYMPTOMS

When you attempt to change your password through the Internet Information Server (IIS) change password feature, you may receive the following error in Internet Explorer:

The server returned and invalid or unrecognized response.

CAUSE

The Web site is configured to support password changing, but the IISADMPWD virtual directory does not exist on that Web site. When Internet Information Server is installed, the IISADMPWD virtual directory is only added to the default Web site.

RESOLUTION

Note Changing passwords by using the IISADMPWD virtual directory should only be done over Secure Sockets Layer (SSL).

To resolve this issue, add a virtual directory named IISADMPWD to the Web site by performing the following steps:

In the Internet Service Manager, click the Web site.
From the Action menu, point to New and then click Virtual Directory.
Type "IISADMPWD" (without the quotation marks) in the alias name box of the New Virtual Directory Wizard, and then click Next.
Type the path to the Winnt\System32\Inetsrv\Iisadmpwd folder, and then click Next.
Click to disable the Allow Script Access.
Click to enable Allow Execute Access (Includes Script Access), and then click Finish.

STATUS

Microsoft has confirmed this to be a problem in Microsoft Internet Information Server version 4.0. We are researching this problem and will post new information here in the Microsoft Knowledge Base as it becomes available.

MORE INFORMATION

Internet Information Server 4.0 includes the capability that allows a Windows NT user to change their password, receive notification when their password is to expire, and allow them to change the password. IIS installs this functionality in the IISADMPWD virtual directory of the default Web site. This feature is implemented as a set of .HTR files located in the %system%\System32\Inetsrv\Iisadmpwd directory and the ISAPI extension file Ism.dll. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

331834 Change password functionality replaced with Active Server Pages

For additional information about configuring Internet Information Server to support password changing, view the section Notifying Clients of Password Status section of the Windows NT 4.0 Option Pack Documentation.