Knowledge Base

This article will review how Specops Password Reset affected/subscription licenses are consumed. Both affected (perpetual) and subscription licenses use the same model to count licenses — the count is based on the number of enabled Active Directory user accounts that have a Specops Password Reset GPO applied to them in Active Directory. Check Current License...

Admin accounts are affected by the adminSDHolder rule, which resets the security permissions on privileged AD accounts every 15 minutes. Possible solution Log in with an account with Domain Admin permissions and run the following command. dsacls "CN=AdminSDHolder, CN=System, <Domain DN>" /G "<ServiceAccount>:CCDC;classStore;" "<ServiceAccount>:LC;;" "<ServiceAccount>:CA;Reset Password;" "<ServiceAccount>:RP;userAccountControl;" "<ServiceAccount>:RPWP;mobile;" "<ServiceAccount>:RPWP;pwdLastSet;" "<ServiceAccount>:RPWP;lockoutTime;" Example: dsacls "CN=AdminSDHolder, CN=System, DC=example,...

Description: If you see user counts that don’t look quite right, or you get a license error in Specops Password Reset, it could be the nightly user counting timing out. To check if this is the issue, we can check our Event Viewer on the Specops Password Reset server. On the Specops Password Reset server,...

In environments where both Specops uReset and Specops Password Reset are installed, Specops Authentication clients will by default direct users to uReset to enroll and reset/change their passwords. We can configure the client via Group Policy or Windows registry changes to instead direct users to Password Reset. Password Reset URLs Begin by identifying the required...

The following error message was received after a Specops Password Reset installation or upgrade: Failed to get the SPR service account UPN from the server ‘..’Identity check failed for outgoing message. The expected DNS identity of the remote endpoint was ‘..’ but the remote endpoint provided DNS claim ‘..’. If this is a legitimate remote...

Delegated Helpdesk does not work against an alias: https://spr.domain.com/specopspassword/helpdesk. You must access the page through the FQDN. Possible solution Add another CN to the certificate. “CN=hostname.domain.local” if using https://hostname.domain.local/specopspassword/helpdesk; Or “CN=hostname” if using just the server name https://hostname/specopspassword/helpdesk.

You have not added the FQDN of the server (or *.mydomain.com) to the local intranet site using the GPO site to Zone Assignment. Possible solution You will need to complete the steps under “Enabling authentication to the Password Reset Web Server” in the Specops Password Reset Installation Guide.

The Specops Password Reset Server Service will not start on the server, the application log is showing the following error: Service failed to start (Initializing ServiceHost)System.InvalidOperationException: Cannot find the X.509 certificate using the following search criteria: StoreName ‘My’, StoreLocation ‘LocalMachine’, FindType ‘FindByThumbprint’, FindValue ‘..’.at System.ServiceModel.Security.SecurityUtils.GetCertificateFromStoreCore(StoreName storeName, StoreLocation storeLocation, X509FindType findType, Object findValue, EndpointAddress target, Boolean...

Possible cause The computer is booting before the network stack has been brought up. This is common when systems are used with wireless or gigabit connected NIC’s. Possible solution You may want to disable Fast Logon Optimization. You can do this with Group Policy, using the Always wait for the network at computer startup and logon policy...

Here is the code below: Here is an example: