Change password functionality replaced with Active Server Pages (331834)

MORE INFORMATION

Using the Ism.dll ISAPI extension potentially exposes the Web server to more of a security risk because Ism.dll must be run under the security context of System. ASP, however, is run under the configurable security context of the current process (such as DLLHost, which uses the user, IWAM_<MachineName>, by default).

Using ASP technology also provides additional benefits, such as the ability to customize the change password functionality pages to include graphics or Web site designs.

This feature is available in the latest service pack for Windows 2000. For additional information, click the following article number to view the article in the Microsoft Knowledge Base: A downloadable package has been created to deliver this ASP functionality for servers that are running IIS 5.0 on Microsoft Windows 2000 Server Service Pack 3 (SP3) or IIS 4.0 on Microsoft Windows NT 4.0 Server Service Pack 6a (SP6a).

Note This package has been tested and approved for use with Microsoft Exchange versions 5.5 and 2000 running Outlook Web Access (OWA). Because OWA references these files with an .htr extension, manually renaming the files breaks the OWA use of the change password functionality.

Windows 2000

To obtain and install this package, follow these steps:

1. Make sure that the Iisadmpwd virtual directory is present. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

   269082 IISADMPWD virtual directory is not created during clean install of IIS 5.0

2. To download the installation package for Windows 2000 Service Pack 2 or Windows 2000 Service Pack 3, visit the following Microsoft Web site:

   http://microsoft.com/downloads/details.aspx?FamilyId=67D0D0F8-2978-4E7A-B079-346314BD2D5E&displaylang=en

3. After you install the tool that converts the .htr pages to use ASP technology, update the .htr pages by using the hotfix packages that are described in the following article in the Microsoft Knowledge Base:

   831047 FIX: You experience various problems when you use the Password Change pages in IIS 5.0

4. In the Iisadmpwd folder, rename the Text.asp file as Text.htr.
5. In Notepad, open the Anot.htr file and the Anot3.htr file. Locate the following line of code.

    <!--#include file = "text.asp"--> 

6. In both files, change the line of code that you located in step 5 to the following line of code.

    <!--#include file = "text.htr"--> 

7. To configure these pages appropriately, follow the instructions that are described in the Microsoft Knowledge Base article in step 3.

Windows NT 4.0 SP6a

To download the installation package, visit the following Microsoft Web site:Note The installation of this package requires that the ADSI client be installed on Windows NT 4.0. When you install the ADSI client for Windows NT, you may have to restart your computer.

To download the ADSI client for Windows NT 4.0, visit the following Microsoft Web site: Additional Details

The following table outlines the current implementations by IIS versions before you install this package:

IIS Version	File Extension	ISAPI Extension Used
4.0	.htr	Ism.dll
5.0 (pre-SP4)	.htr	Ism.dll
5.0 (SP4)	.htr	Asp.dll
5.1	.asp	Asp.dll
6.0	.asp	Asp.dll

The installation of this download, Ism2asp.exe, changes any use of Ism.dll in the table to Asp.dll. The file name extension, .htr, remains the same although the page itself is written with ASP technology and Microsoft Visual Basic Scripting Edition (VBScript).