Table of Contents

Issue

 Self-Service password reset appears to be failing with error 3000 from the FIM Password Reset web portal, but the password change is actually successful.

FIM Service Trace

FIMService trace revealed the following error:

PWReset Activity's MIIS Password Set call failed with call-failure:0x80004005

Cause

Read LockoutTime and Write LockoutTime permissions were not granted to the AD MA account for the OU containing the password reset users.

More information

Usually, if ADMA account permissions are set incorrectly we will see 'ma-access-denied' right after the WQL Select statement in the FIM Service trace.  ma-access-denied is thrown if 'Change Password' and 'Reset Password' permissions are not set for the AD MA account for all descendent user objects in the OU.

Minimum OU permissions needed for ADMA account to reset passwords with FIM Self-Service Password Reset

Apply to: Descendent User Objects:

  • Object
    • Change Password
    • Reset Password
  • Properties
    • Read lockoutTime
    • Write lockoutTime