Configuring password change permissions for Unified Access Gateway (UAG)

Users can change their user password through the UAG portal. Providing this functionality, it is mandatory that the Active Directory configuration is using a hostname or fully qualified domain name instead of an IP-address. See Configuring Active Directory authentication for more information. It is also required to enable the account used as Server access credentials in the UAG Active Directory configuration with extended permissions. Follow these steps to allow the Server access credentials changing user passwords.

1. Start the Active Directory Users and Computers management console (dsa.msc).
2. Select the OU where the server access credentials should have change password permissions.
3. Right-click the OU and select Delegate Control from the context menu.
4. Click Next to start the delegation wizard.
5. Click Add to specify the user account that is used as Server access credentials in UAG.
6. Click Next to continue.
    
7. In the Tasks to Delegate select Create a custom task to delegate and click Next
   
8. In the Active Directory Object Type dialog, select Only the following objects in the folder and mark User Objects. Click Next to continue.
   
9. In the Permissions dialog, mark General and mark Change Password. Click Next to continue the wizard.