Cisco ASA VPN LDAP Password Management

If you wish to enable password management for LDAP on a Cisco ASA VPN profile, there are certain requirements to be met.

  1. LDAP over SSL must be enabled for the aaa-server group.  Issue the command: ldap-over-ssl enable on the aaa-server host properties.
  2. The domain controller(s) that you are authenticating to must support LDAPS. You can accomplish this by installing Certificate Services on the domain controller and rebooting it. Once that is done, it will accept LDAPS queries.
  3. You must enable the command password-management on the tunnel-group for the VPN.
  4. Optionally, you can use option  password-expire-in-days <# of days> under password-management to notify users that their password will be expiring. If you do not specify that, users will not be notified but will still be able to change their password once it expires.
See the below commands for an example of a full configuration.
aaa-server MyLDAP protocol ldap
aaa-server MyLDAP (inside) host
 ldap-base-dn DC=My, DC=com
 ldap-scope subtree
 ldap-naming-attribute sAMAccountName
 ldap-login-password *****
 ldap-login-dn CN=ASA VPN, CN=Users, DC=My, DC=com
 ldap-over-ssl enable
 server-type microsoft

tunnel-group Myvpn-LDAP general-attributes
 address-pool ippool2
 authentication-server-group MyLDAP
 default-group-policy Myvpn-AD
 password-management password-expire-in-days 3

Windows 2003 RDP Desktop session or parts of Desktop session is black

I had an issue today where I was connecting to a Windows Server 2003 machine and after logging in my RDP desktop was black.  I could see icons, but text, menus, etc., did not show up.  This is due to corrupted/incorrect color settings in the registry.

Here is what I did to fix it.  Replace the bold parts with your SID.

  1. Opened the registry and browsed to HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PROFILELIST and found the SID associated with my login account. In this case, it was S-1-5-21-269 (part of the SID omitted)
  2. Still in registry editor, browsed to HKEY_USERS\S-1-5-21-269\CONTROL PANEL\COLORS
  3. I noticed most of the values, if not all, were set to ‘0 0 0’.  I backed up the registry key.
  4. Create a new registry editor file (.reg) and paste these values into it:
    [HKEY_USERS\S-1-5-21-269\Control Panel\Colors]
    “ActiveBorder”=”212 208 200”
    “ActiveTitle”=”0 84 227”
    “AppWorkSpace”=”128 128 128”
    “Background”=”0 78 152”
    “ButtonAlternateFace”=”181 181 181”
    “ButtonDkShadow”=”113 111 100”
    “ButtonFace”=”236 233 216”
    “ButtonHilight”=”255 255 255”
    “ButtonLight”=”241 239 226”
    “ButtonShadow”=”172 168 153”
    “ButtonText”=”0 0 0”
    “GradientActiveTitle”=”61 149 255”
    “GradientInactiveTitle”=”157 185 235”
    “GrayText”=”172 168 153”
    “Hilight”=”49 106 197”
    “HilightText”=”255 255 255”
    “HotTrackingColor”=”0 0 128”
    “InactiveBorder”=”212 208 200”
    “InactiveTitle”=”122 150 223”
    “InactiveTitleText”=”216 228 248”
    “InfoText”=”0 0 0”
    “InfoWindow”=”255 255 225”
    “Menu”=”255 255 255”
    “MenuText”=”0 0 0”
    “Scrollbar”=”212 208 200”
    “TitleText”=”255 255 255”
    “Window”=”255 255 255”
    “WindowFrame”=”0 0 0”
    “WindowText”=”0 0 0”
    “MenuHilight”=”49 106 197”
    “MenuBar”=”236 233 216”
  5. Place the .reg file on the machine in question and import the settings into the registry.  Log on with the user and all color settings should be restored.