Technical Tip: How to perform a manual password change via a Windows Machine template on a non-domain joined workstation

Regarding this error, there must be configured prerequisites for credential change via SMB on the non-domain-joined workstation.

This error: SAMR connection to the machine failed. The error NT_STATUS_ACCESS_DENIED is related to a Microsoft registry setting that should be adjusted.

The displayed error mentions that the SAMR (Security Account Manager) connection (remote SAM connection, or SAM-R) to the machine failed.

This means that the user is not able to perform a password change via SMB because it is not allowed to make remote calls to SAM (Security Account Manager).

• In this case, some changes need to be made in the local workstations Group Policy under:
  Computer configuration -> Windows settings -> Security settings -> Local policies -> Security options, select the 'Network access: Restrict clients allowed to make remote calls to SAM'.
  
  

• Add the Directory Services Account (DSA) to the list of approved accounts to perform this action.

Note: In Windows Server 2025, Microsoft has updated its security policy and no longer allows password changes via Samba.

Refer to Troubleshooting Tip: Cannot change the password for Windows Local User.