Enable Password Changes with Outlook Web Access 2000

Outlook Web Access 2000 includes a Change Password button in its Options page. Clicking the button launches a popup window that tries to run IISADMPWD, the domain password change applet that comes with IIS 5.0. The default Exchange/OWA 2000 installation does not enable this feature, yet it includes the button on the Options page. The logical assumption is that the button should either do something when clicked or it should be removed. The following article describes how to activate the Change Password button or to remove it from the Options page.

Activate the Change Password Option

Activating the Change Password option requires two things to take place. First, the OWA server must have Secure Socket Layer (SSL) installed and configured. Second, the OWA site in IIS must have a virtual directory installed to point to the password applet directory.

Installing SSL

SSL allows OWA users to use a secure connection to change passwords. To set up SSL for OWA, and IIS in general, the server has to run Microsoft's Certificate Server, which comes as part of Windows 2000 Server. Certificate Server can issue certificates for intranet use, but if access from the internet is required, you will need a key certificate from a Certificate Authority (CA). Verisign is an example of a CA that offers web security services, and issues SSL certificates for an annual fee. (Note: Certificate Server can also issue non-certified keys, but will generate security alerts warning users that the certificate can not be trusted. Users can choose to trust the site despite the warning, and proceed to log in.)

Configuring OWA/IIS

Once SSL is installed and configured on the OWA server, the next step is to create a virtual directory that points to where the domain password change applet resides. As a security measure, IIS installs the applet code in a folder, but does not activate it. Creating a virtual directory will in effect turn on the change password feature, by making OWA aware of the applet's existence. The Change Password button's link points to the applet within the virtual directory.

Once both tasks are completed, the Change Password option should work properly.

Remove the Change Password Option

Warning: The following text includes instructions on modifying the system registry. Use extreme caution whenever you make changes to the registry. Inadvertant modifications may cause irrepairable damage to your operating system.

Make sure that you are logged on as a user with administrative privileges.

  1. Open up the Registry Editor (Click on the Start Button, select Run, and type REGEDIT)
  2. Close the Registry Editor.

The Change Password button should no longer be available in OWA.

Related Pages

Microsoft Support Page: How to Configure Certificate Server for Use with SSL on IIS (Article ID: 218445)

Microsoft Support Page: XWEB: How to Change OWA Passwords Through IIS (Article ID: 267596)

Microsoft Support Page: How to Enable Password Change Functionality for OWA (Article ID: 268419)

Microsoft Support Page: XWEB - How to Hide the Change Password Button on the Outlook Web Access Options Page (Article ID: 297121)