password changing from Windows

[Dave Love <d.love@dl.ac.uk>]

The current release says it supports the Windows password-change
protocol.  Are you expected to be able to use this with the normal
Windows ctl-alt-del change password business when authenticating
against Heimdal via Active Directory with a trust relationship?

When I try it from Windows XP with a Windows 2003 AD controller
trusting Heimdal 0.6.3, Windows says the password can't be changed.
The KDC log does show a changepw ticket being issued.

If it should work, any suggestions for configuration fixes or
debugging?  Thanks.