Access Denied: Solving Password Problems That Involve Your PDC

[Editor's Note: Do you have a security-related question about Windows 2000? Send it to [email protected], and you might see the answer in this column!]

I manage the Help desk for a company that has several remote locations. Several users at one location have received the error message Unable to change password on this account. Code: c00000be when their passwords have expired and they've tried to enter a new password. I'm running Windows 2000 Server and Windows NT 4.0 Service Pack 6a (SP6a) on the workstations. I suspect that the server might contribute to the problem. My current workaround is to access the BDC and use User Manager to enter the new password. But how can I address the basic problem?

Executing a password reset from an NT workstation on a user account in an NT domain doesn't involve member servers such as the Win2K server at your remote location. Code c00000be indicates that your workstation can't reach the PDC. Check the filters on your routers between the remote location and the PDC. Try to ping your PDC from a workstation in the remote location to make sure your workstations can reach the PDC.