Hello,
Some months back we've migrated our Exchange 2007 Server to 2013.
Everything's well except all users that were created before the migrationcannot change their domain password (using Ctrl+Alt+Del they get "Access Denied"). Only Admins can change the user passwords in AD Users and Computers as Admin (or comparable ways).
All users created after the migration are not affected by this issue.
Before the migration there was no such issue.
In users properties, if I check the security permissions, the affected users have the "Change Password" permission unset. Whereas the unaffected users have it set to Allow.
If I change it to allow, the users can change the password, but after some time (anywhere between a few minutes and a few hours) it gets unset.
I've set an audit rule to check what is unsetting the permission, but that also gets modified, so I get nothing in Event Viewer.
I have no GPO that could determine this behavior.
If I copy an affected user, the new user is also affected.
Our schema is at 2008R2 level.
If someone has any idea, I would appreciate it.