OWA password change displays %iis.REMOTE_USER% in account field (328128)

We strongly recommend that all users upgrade to Microsoft Internet Information Services (IIS) version 6.0 running on Microsoft Windows Server 2003. IIS 6.0 significantly increases Web infrastructure security. For more information about IIS security-related topics, visit the following Microsoft Web site:

http://www.microsoft.com/technet/security/prodtech/IIS.mspx

SYMPTOMS

When you try to change a password in Outlook Web Access or any Web site by using the IISADMPWD virtual directory functionality, the account field displays the following text:

<%iis.REMOTE_USER%>

If you type the correct information in the fields and try to continue, you may receive the following error message in your browser:

The page cannot be displayed

The page you are looking for might have been removed or had its name changed.

Please try the following:
Open the %iis.server_name% <http://%iis.server_name%> home page, and then look for links to the information you want.

If you typed the page address in the Address bar, make sure that it is spelled correctly.

If you still cannot open the page, click the Internet Explorer <>Search <> button to look for similar sites.

RESOLUTION

Open the Internet Services Manager (ISM), and then locate the Web site.
Right-click the IISADMPWD virtual directory for your Web site, and then click Properties.
On the Virtual Directory tab, click Configuration.
Locate Application Mappings, and then make sure that the .htr mapping exists in the Extension list. If the .htr mapping exists, use Windows Explorer to open the path that the mapping specifies to verify that the Asp.dll file exists in that folder.

If the .htr application extension mapping does not exist:
1. Click Add.
2. In the Add/Edit Application Extension Mapping dialog box, type the following path in the Executable text box:
```
C:\winnt\system32\inetsrv\asp.dll
```
  NOTE: When you browse to this location, change Files of type to Dynamic Linked Libraries (*.dll) to allow .dll files to appear.
3. Under Verbs, select Limit to, and then type GET, POST. Remember to add the comma between the verbs. In IIS 4.0, you must type the verbs in uppercase letters.

MORE INFORMATION

The IIS Lockdown Tool can be configured to remove the mapping for the .htr extension, which causes this problem.

You can also use Active Server Pages (ASP) to provide change password functionality. For more information about change password functionality that is based on ASP, click the following article number to view the article in the Microsoft Knowledge Base:

331834 Change password functionality replaced with Active Server Pages