Change Password [Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))]

Question

I am using ITaCS Change Password 2.5 webpart on wss3.0 for a while now and all of a sudden everytime a user trys to change their password they get the error.

You must not change your password. [Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))]

User account can change passwords via ctrl+alt+del and webconfig is setup with identity impersonate="true". Any ideas why the webpart would stop working all of a sudden?

Answer 1

Did you tried following steps yet, I found them at ITaCS change password webpart discussion page, I couldn't find source code on there site though to go through it and see where it giving error as there's several other people having same type of problem with this webpart.

can you please check the specific account with a tool like ADSI Edit? There is an Active Directory property "adminCount" which may prevent the password from being changed through applications like the change password web part. For a detailed description of the adminCount property follow this link to the MSDN: Article Source

If the property is set to 1 you won't be able to change the password via the change password web part.

Discussion Source

EDIT

Right, Can you use ULS Viewer to find out if while you are trying to change password any error is coming up in ULS logs, Guide to use ULS Viewer can be find in this Blog post,

How to Use ULS Viewer on SharePoint Server

Edit 2

Application Pool Identity:

The application pool identity is essentially what the ASP .Net code of the portal site will be executing as. The user account used here must have the standard rights in order to run an application pool, and must obviously have rights to read and write to the SQL Server databases for the portal. When the portal is created the designated user account is given these permissions automatically, hence you shouldn’t need to change this. However, in the references section is a link to an article which describes how to change identity of existing application pool or change application on a portal site if needed. The following rights are required for the application pool identity:

Must be a member of the IIS_WPG, SPS_WPG, and STS_WPG groups on the web server

Must be a Db_owner on these databases; portal site _SITE database, _SERV database, _PROF database, and for the configuration database (by default, this is SPS01_Config_db)

Source for more information.

Edit 3

Try these steps,

Resolution: Add the correct permissions to the OU

On a server that has the Active Directory tools installed, open the Active Directory Users and Computers snap-in as a user who has sufficient domain permissions, such as domain administrator. To open Active Directory Users and Computers, click Start, click Run, and then type dsa.msc.

In the console tree, right-click the OU for which you want to delegate control.

Click Delegate Control to start the Delegation of Control Wizard, and then follow the instructions in the wizard.

In the Welcome pane, click Next.

In the Users and Groups pane, click Add.

In the Enter the object names to select box, type the user name that you plan to use for the administration application pool identity, and then click OK.

Click Next.

In the Tasks to Delegate pane, select the Create, delete, and manage user accounts and Read all user information check boxes, and then click Next.

Click Finish.

Soruce

Answer 2

I just installed the ITaCS Change Password 2.6 today and was running into the exact same error when trying to change the password for a user.

You must not change your password. [Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))]

I was able to solve this by changing the user's account options: Properties dialog->Account tab->Account Options: Uncheck "User cannot change password"

I realize that this is pretty elementary, but it was the solution for my situation.

Environment: Windows Server 2003 SP2 and SharePoint 2010