Errors Connecting Through RAS When Password Expires

• Microsoft Windows NT Server versions 3.51 and 4.0
• Microsoft Windows for Workgroups version 3.11
• Microsoft Windows 95

SYMPTOMS

When you attempt to connect to a Windows NT Remote Access Service (RAS) server, you may experience one of the following problems:

Windows 95 Dial-Up Networking (DUN) Client

You may be prompted to change your password and/or you may receive the following error:

   The computer you have dialed in to has denied access because the
   username and/or password is invalid on the domain.

Windows for Workgroups 3.11 RAS Client

You may receive the following error:

   Error 649: The Account does not have Remote Access permission.

• Your Windows NT domain account is configured to expire passwords or you enable the Change Password at Next Logon option in User Manager for Domains.
• The RAS Server is running Windows NT configured as a member server and is participating in a domain.
• Your user account is not in the RAS server's local user account security (SAM) database, but only in the domain database.

RESOLUTION

To resolve this issue, you will need to use one of the following methods, depending on the version of Windows NT Server that is operating as your RAS server:

Windows NT Server 3.51

• If you want to expire passwords or use the Change Password at Next Logon option, you will need to move your RAS server to a Windows NT computer that is configured as a domain controller.

  -or-

• Do not use password expirations.

Windows NT Server 4.0

Obtain the following fix or wait for the next Windows NT service pack.

This fix should have the following timestamp:

   04/07/97  04:02 PM                49,936 Raspppen.dll (Intel)
   06/30/97  09:20 PM                28,432 Rassauth.dll (Intel)

-or-

   04/07/97  03:13 PM                81,680 Raspppen.dll (Alpha)
   06/26/97  08:00 PM                53,008 Rassauth.dll (Alpha)

STATUS

Microsoft has confirmed this to be a problem in Windows NT version 4.0. A supported fix is now available, but has not been fully regression tested and should be applied only to systems experiencing this specific problem. Unless you are severely impacted by this specific problem, Microsoft recommends that you wait for the next Service Pack that contains this fix. Contact Microsoft Technical Support for more information.

Microsoft has confirmed this to be a problem in Windows NT version 3.51. We are researching this problem and will post new information here in the Microsoft Knowledge Base as it becomes available.