Changing Password to an account that has to change password at first logon using System.DirectoryServices

[Fabrizio]

(Sorry for the crosspost, but I really don't know which is the right
newsgroup!)
Hi all,

I try to change the password to a user that as to change the password at
first logon:
try

{

DirectoryEntry de = new DirectoryEntry();

de.AuthenticationType = AuthenticationTypes.ServerBind |
AuthenticationTypes.Secure;

de.Path = "LDAP://10.0.50.20/cn=users,dc=newtesthp,dc=com";

de.Username = "cn=fv,cn=users,dc=newtesthp,dc=com";

de.Password = "fv";

DirectorySearcher ds = new DirectorySearcher(de, "cn=fv");

SearchResult sr = ds.FindOne();

DirectoryEntry usr = sr.GetDirectoryEntry();

usr.Invoke("ChangePassword",new object[]{"fv","12345qwert"});

usr.CommitChanges();

}

catch(Exception e)

{

Console.WriteLine(e.Message);

}

I an exception that says "Logon failure: unknown user name or bad password"
and it seems to me that I have
no way neither to change the password nor to distinguish a wrong credential
error from a an error due to a disabled account, a password expired.

Do you have any suggestion to solve this problem.

Thanks

Fabrizio

[Ben Dewey]

Fabrizio,

Try to the usr.Invoke('SetPassword', new object[]{"new password"});

or I actually use:

using System;
using System.DirectoryServices;

using ActiveDs;

public static void ChangePassword(string username, string password)
{
try
{
DirectoryEntry de = new DirectoryEntry(LdapPath, LdapUser,
LdapPassword);
DirectorySearcher search = new DirectorySearcher(de,
"(samAccountName=" + username+ ")");
SearchResult result = search.FindOne();
return new DsUser(result.GetDirectoryEntry());
// Set Password and Enable Account
IADsUser objUser = (IADsUser)user.NativeObject;
objUser.SetPassword(password);
}
catch(Exception exp)
{
throw exp;
}
}

This doesn't require you have know the old password and might help resolve
your authetication issues. That is, assuming you are authenticating to AD
successfully. Let me know if this helps. If not, What line are you getting
the error message on.
"Fabrizio" <xx*********************@xxxhotmail.com> wrote in message
news:eL*************@TK2MSFTNGP11.phx.gbl...

(Sorry for the crosspost, but I really don't know which is the right
newsgroup!)
Hi all,

I try to change the password to a user that as to change the password at
first logon:
try

{

DirectoryEntry de = new DirectoryEntry();

de.AuthenticationType = AuthenticationTypes.ServerBind |
AuthenticationTypes.Secure;

de.Path = "LDAP://10.0.50.20/cn=users,dc=newtesthp,dc=com";

de.Username = "cn=fv,cn=users,dc=newtesthp,dc=com";

de.Password = "fv";

DirectorySearcher ds = new DirectorySearcher(de, "cn=fv");

SearchResult sr = ds.FindOne();

DirectoryEntry usr = sr.GetDirectoryEntry();

usr.Invoke("ChangePassword",new object[]{"fv","12345qwert"});

usr.CommitChanges();

}

catch(Exception e)

{

Console.WriteLine(e.Message);

}

I an exception that says "Logon failure: unknown user name or bad password" and it seems to me that I have
no way neither to change the password nor to distinguish a wrong credential error from a an error due to a disabled account, a password expired.

Do you have any suggestion to solve this problem.

Thanks

Fabrizio

[Joe Kaplan \(MVP - ADSI\)]

Also, you should really never bind to AD supplying credentials without
adding AuthenticationTypes.Secure to your DirectoryEntry constructor.
Otherwise you are using simple bind and credentials are passed in clear text
over the network.

Additionally, it is always a good idea to call Dispose on all of the
IDisposable S.DS classes, DirectoryEntry, DirectorySearcher and
SearchResultCollection, or they will tend to leak memory. DirectoryEntry is
especially problematic because the Finalize method has a bug where it
doesn't release the underlying COM object (fixed in Whidbey). C# folks can
use the "using" construct.

Joe K.

"Ben Dewey" <be*******@scientiae.com> wrote in message
news:%2***************@TK2MSFTNGP10.phx.gbl...

Fabrizio,

Try to the usr.Invoke('SetPassword', new object[]{"new password"});

or I actually use:

using System;
using System.DirectoryServices;

using ActiveDs;

public static void ChangePassword(string username, string password)
{
try
{
DirectoryEntry de = new DirectoryEntry(LdapPath, LdapUser,
LdapPassword);
DirectorySearcher search = new DirectorySearcher(de,
"(samAccountName=" + username+ ")");
SearchResult result = search.FindOne();
return new DsUser(result.GetDirectoryEntry());
// Set Password and Enable Account
IADsUser objUser = (IADsUser)user.NativeObject;
objUser.SetPassword(password);
}
catch(Exception exp)
{
throw exp;
}
}

This doesn't require you have know the old password and might help resolve
your authetication issues. That is, assuming you are authenticating to AD
successfully. Let me know if this helps. If not, What line are you getting the error message on.
"Fabrizio" <xx*********************@xxxhotmail.com> wrote in message
news:eL*************@TK2MSFTNGP11.phx.gbl...

(Sorry for the crosspost, but I really don't know which is the right
newsgroup!)
Hi all,

I try to change the password to a user that as to change the password at
first logon:
try

{

DirectoryEntry de = new DirectoryEntry();

de.AuthenticationType = AuthenticationTypes.ServerBind |
AuthenticationTypes.Secure;

de.Path = "LDAP://10.0.50.20/cn=users,dc=newtesthp,dc=com";

de.Username = "cn=fv,cn=users,dc=newtesthp,dc=com";

de.Password = "fv";

DirectorySearcher ds = new DirectorySearcher(de, "cn=fv");

SearchResult sr = ds.FindOne();

DirectoryEntry usr = sr.GetDirectoryEntry();

usr.Invoke("ChangePassword",new object[]{"fv","12345qwert"});

usr.CommitChanges();

}

catch(Exception e)

{

Console.WriteLine(e.Message);

}

I an exception that says "Logon failure: unknown user name or bad

password"

and it seems to me that I have
no way neither to change the password nor to distinguish a wrong

credential

error from a an error due to a disabled account, a password expired.

Do you have any suggestion to solve this problem.

Thanks

Fabrizio

[Fabrizio]

Thanks Ben,
If the user must change password at next logon I got the same exception
executing the following line:
SearchResult result = search.FindOne();
otherwise if the user is not forced to change password, I got a
System.UnauthorizedAccessException ("Access is denied.")
executing the following line of code:
objUser.SetPassword("newpassword");

This is different from using only DirectoryEntry:
DirectoryEntry de = new DirectoryEntry();
de.AuthenticationType = AuthenticationTypes.ServerBind |
AuthenticationTypes.Secure;
de.Path = "LDAP://10.0.50.20/cn=fv,cn=users,dc=newtesthp,dc=com";
de.Username = "cn=fv,cn=users,dc=newtesthp,dc=com";
de.Password = "fv";
de.Invoke("changepassword",new object[]{"fv","q1w2q1w2q1"});
de.CommitChanges();
If the user must change password at next logon I always got the same
exception (Logon failure: unknown user name or bad password)
executing the following line:
de.Invoke("changepassword",new object[]{"fv","q1w2q1w2q1"});
otherwise if the user is not forced to change password, I am able to change
the password.

I think that the only solution is,on failure, to try to change the password
with NetUserChangePassword.
This is not what I liked to do but I don't see any other solution.
What do you think about it?

Fabrizio


"Ben Dewey" <be*******@scientiae.com> wrote in message
news:#b*************@TK2MSFTNGP10.phx.gbl...

Fabrizio,

Try to the usr.Invoke('SetPassword', new object[]{"new password"});

or I actually use:

using System;
using System.DirectoryServices;

using ActiveDs;

public static void ChangePassword(string username, string password)
{
try
{
DirectoryEntry de = new DirectoryEntry(LdapPath, LdapUser,
LdapPassword);
DirectorySearcher search = new DirectorySearcher(de,
"(samAccountName=" + username+ ")");
SearchResult result = search.FindOne();
return new DsUser(result.GetDirectoryEntry());
// Set Password and Enable Account
IADsUser objUser = (IADsUser)user.NativeObject;
objUser.SetPassword(password);
}
catch(Exception exp)
{
throw exp;
}
}

This doesn't require you have know the old password and might help resolve
your authetication issues. That is, assuming you are authenticating to AD
successfully. Let me know if this helps. If not, What line are you getting the error message on.
"Fabrizio" <xx*********************@xxxhotmail.com> wrote in message
news:eL*************@TK2MSFTNGP11.phx.gbl...

(Sorry for the crosspost, but I really don't know which is the right
newsgroup!)
Hi all,

I try to change the password to a user that as to change the password at
first logon:
try

{

DirectoryEntry de = new DirectoryEntry();

de.AuthenticationType = AuthenticationTypes.ServerBind |
AuthenticationTypes.Secure;

de.Path = "LDAP://10.0.50.20/cn=users,dc=newtesthp,dc=com";

de.Username = "cn=fv,cn=users,dc=newtesthp,dc=com";

de.Password = "fv";

DirectorySearcher ds = new DirectorySearcher(de, "cn=fv");

SearchResult sr = ds.FindOne();

DirectoryEntry usr = sr.GetDirectoryEntry();

usr.Invoke("ChangePassword",new object[]{"fv","12345qwert"});

usr.CommitChanges();

}

catch(Exception e)

{

Console.WriteLine(e.Message);

}

I an exception that says "Logon failure: unknown user name or bad

password"

and it seems to me that I have
no way neither to change the password nor to distinguish a wrong

credential

error from a an error due to a disabled account, a password expired.

Do you have any suggestion to solve this problem.

Thanks

Fabrizio

[Ben Dewey]

Joe,

Along these lines, if you are using some ActiveDs Objects in C#, ie. SecUtil
and SecDescp Classes, what is the best way to dispose of them?

"Joe Kaplan (MVP - ADSI)" <jo*************@removethis.accenture.com> wrote
in message news:Oj**************@TK2MSFTNGP09.phx.gbl...

Also, you should really never bind to AD supplying credentials without
adding AuthenticationTypes.Secure to your DirectoryEntry constructor.
Otherwise you are using simple bind and credentials are passed in clear text over the network.

Additionally, it is always a good idea to call Dispose on all of the
IDisposable S.DS classes, DirectoryEntry, DirectorySearcher and
SearchResultCollection, or they will tend to leak memory. DirectoryEntry is especially problematic because the Finalize method has a bug where it
doesn't release the underlying COM object (fixed in Whidbey). C# folks can use the "using" construct.

Joe K.

"Ben Dewey" <be*******@scientiae.com> wrote in message
news:%2***************@TK2MSFTNGP10.phx.gbl...

Fabrizio,

Try to the usr.Invoke('SetPassword', new object[]{"new password"});

or I actually use:

using System;
using System.DirectoryServices;

using ActiveDs;

public static void ChangePassword(string username, string password)
{
try
{
DirectoryEntry de = new DirectoryEntry(LdapPath, LdapUser,
LdapPassword);
DirectorySearcher search = new DirectorySearcher(de,
"(samAccountName=" + username+ ")");
SearchResult result = search.FindOne();
return new DsUser(result.GetDirectoryEntry());
// Set Password and Enable Account
IADsUser objUser = (IADsUser)user.NativeObject;
objUser.SetPassword(password);
}
catch(Exception exp)
{
throw exp;
}
}

This doesn't require you have know the old password and might help resolve your authetication issues. That is, assuming you are authenticating to AD successfully. Let me know if this helps. If not, What line are you

getting

the error message on.
"Fabrizio" <xx*********************@xxxhotmail.com> wrote in message
news:eL*************@TK2MSFTNGP11.phx.gbl...

(Sorry for the crosspost, but I really don't know which is the right
newsgroup!)
Hi all,

I try to change the password to a user that as to change the password at first logon:
try

{

DirectoryEntry de = new DirectoryEntry();

de.AuthenticationType = AuthenticationTypes.ServerBind |
AuthenticationTypes.Secure;

de.Path = "LDAP://10.0.50.20/cn=users,dc=newtesthp,dc=com";

de.Username = "cn=fv,cn=users,dc=newtesthp,dc=com";

de.Password = "fv";

DirectorySearcher ds = new DirectorySearcher(de, "cn=fv");

SearchResult sr = ds.FindOne();

DirectoryEntry usr = sr.GetDirectoryEntry();

usr.Invoke("ChangePassword",new object[]{"fv","12345qwert"});

usr.CommitChanges();

}

catch(Exception e)

{

Console.WriteLine(e.Message);

}

I an exception that says "Logon failure: unknown user name or bad

password"

and it seems to me that I have
no way neither to change the password nor to distinguish a wrong

credential

error from a an error due to a disabled account, a password expired.

Do you have any suggestion to solve this problem.

Thanks

Fabrizio

[Joe Kaplan \(MVP - ADSI\)]

That is a good question which is probably better posed to the interop
newsgroup than anywhere else. My assumption is that that CCW takes care of
that for you, but I don't know for sure.

Joe K.

"Ben Dewey" <As*********@hotmail.com> wrote in message
news:e%***************@TK2MSFTNGP11.phx.gbl...

Joe,

Along these lines, if you are using some ActiveDs Objects in C#, ie. SecUtil and SecDescp Classes, what is the best way to dispose of them?

"Joe Kaplan (MVP - ADSI)" <jo*************@removethis.accenture.com> wrote
in message news:Oj**************@TK2MSFTNGP09.phx.gbl...

Also, you should really never bind to AD supplying credentials without
adding AuthenticationTypes.Secure to your DirectoryEntry constructor.
Otherwise you are using simple bind and credentials are passed in clear text

over the network.

Additionally, it is always a good idea to call Dispose on all of the
IDisposable S.DS classes, DirectoryEntry, DirectorySearcher and
SearchResultCollection, or they will tend to leak memory. DirectoryEntry is

especially problematic because the Finalize method has a bug where it
doesn't release the underlying COM object (fixed in Whidbey). C# folks can

use the "using" construct.

Joe K.

"Ben Dewey" <be*******@scientiae.com> wrote in message
news:%2***************@TK2MSFTNGP10.phx.gbl...

Fabrizio,

Try to the usr.Invoke('SetPassword', new object[]{"new password"});

or I actually use:

using System;
using System.DirectoryServices;

using ActiveDs;

public static void ChangePassword(string username, string password)
{
try
{
DirectoryEntry de = new DirectoryEntry(LdapPath, LdapUser,
LdapPassword);
DirectorySearcher search = new DirectorySearcher(de,
"(samAccountName=" + username+ ")");
SearchResult result = search.FindOne();
return new DsUser(result.GetDirectoryEntry());
// Set Password and Enable Account
IADsUser objUser = (IADsUser)user.NativeObject;
objUser.SetPassword(password);
}
catch(Exception exp)
{
throw exp;
}
}

This doesn't require you have know the old password and might help

resolve your authetication issues. That is, assuming you are authenticating

to AD successfully. Let me know if this helps. If not, What line are you getting

the error message on.
"Fabrizio" <xx*********************@xxxhotmail.com> wrote in message
news:eL*************@TK2MSFTNGP11.phx.gbl...
> (Sorry for the crosspost, but I really don't know which is the right
> newsgroup!)
> Hi all,
>
> I try to change the password to a user that as to change the

password at > first logon:
> try
>
> {
>
> DirectoryEntry de = new DirectoryEntry();
>
> de.AuthenticationType = AuthenticationTypes.ServerBind |
> AuthenticationTypes.Secure;
>
> de.Path = "LDAP://10.0.50.20/cn=users,dc=newtesthp,dc=com";
>
> de.Username = "cn=fv,cn=users,dc=newtesthp,dc=com";
>
> de.Password = "fv";
>
> DirectorySearcher ds = new DirectorySearcher(de, "cn=fv");
>
> SearchResult sr = ds.FindOne();
>
> DirectoryEntry usr = sr.GetDirectoryEntry();
>
> usr.Invoke("ChangePassword",new object[]{"fv","12345qwert"});
>
> usr.CommitChanges();
>
> }
>
> catch(Exception e)
>
> {
>
> Console.WriteLine(e.Message);
>
> }
>
> I an exception that says "Logon failure: unknown user name or bad
password"
> and it seems to me that I have
> no way neither to change the password nor to distinguish a wrong
credential
> error from a an error due to a disabled account, a password expired.
>
> Do you have any suggestion to solve this problem.
>
> Thanks
>
> Fabrizio
>
>

[Joe Kaplan \(MVP - ADSI\)]

SetPassword requires the Reset Password permission which is usually only
given out to Admins and Account Operators. ChangePassword is usually given
to regulars users for their own objects.

Unfortunately, ADSI won't let you bind with a user's credentials if they
need to change the password at next login, so I don't think you can use ADSI
to do what you want to do.

Joe K.

"Fabrizio" <xx*********************@xxxhotmail.com> wrote in message
news:uY**************@TK2MSFTNGP11.phx.gbl...

Thanks Ben,
If the user must change password at next logon I got the same exception
executing the following line:
SearchResult result = search.FindOne();
otherwise if the user is not forced to change password, I got a
System.UnauthorizedAccessException ("Access is denied.")
executing the following line of code:
objUser.SetPassword("newpassword");

This is different from using only DirectoryEntry:
DirectoryEntry de = new DirectoryEntry();
de.AuthenticationType = AuthenticationTypes.ServerBind |
AuthenticationTypes.Secure;
de.Path = "LDAP://10.0.50.20/cn=fv,cn=users,dc=newtesthp,dc=com";
de.Username = "cn=fv,cn=users,dc=newtesthp,dc=com";
de.Password = "fv";
de.Invoke("changepassword",new object[]{"fv","q1w2q1w2q1"});
de.CommitChanges();
If the user must change password at next logon I always got the same
exception (Logon failure: unknown user name or bad password)
executing the following line:
de.Invoke("changepassword",new object[]{"fv","q1w2q1w2q1"});
otherwise if the user is not forced to change password, I am able to change the password.

I think that the only solution is,on failure, to try to change the password with NetUserChangePassword.
This is not what I liked to do but I don't see any other solution.
What do you think about it?

Fabrizio


"Ben Dewey" <be*******@scientiae.com> wrote in message
news:#b*************@TK2MSFTNGP10.phx.gbl...

Fabrizio,

Try to the usr.Invoke('SetPassword', new object[]{"new password"});

or I actually use:

using System;
using System.DirectoryServices;

using ActiveDs;

public static void ChangePassword(string username, string password)
{
try
{
DirectoryEntry de = new DirectoryEntry(LdapPath, LdapUser,
LdapPassword);
DirectorySearcher search = new DirectorySearcher(de,
"(samAccountName=" + username+ ")");
SearchResult result = search.FindOne();
return new DsUser(result.GetDirectoryEntry());
// Set Password and Enable Account
IADsUser objUser = (IADsUser)user.NativeObject;
objUser.SetPassword(password);
}
catch(Exception exp)
{
throw exp;
}
}

This doesn't require you have know the old password and might help resolve your authetication issues. That is, assuming you are authenticating to AD successfully. Let me know if this helps. If not, What line are you

getting

the error message on.
"Fabrizio" <xx*********************@xxxhotmail.com> wrote in message
news:eL*************@TK2MSFTNGP11.phx.gbl...

(Sorry for the crosspost, but I really don't know which is the right
newsgroup!)
Hi all,

I try to change the password to a user that as to change the password at first logon:
try

{

DirectoryEntry de = new DirectoryEntry();

de.AuthenticationType = AuthenticationTypes.ServerBind |
AuthenticationTypes.Secure;

de.Path = "LDAP://10.0.50.20/cn=users,dc=newtesthp,dc=com";

de.Username = "cn=fv,cn=users,dc=newtesthp,dc=com";

de.Password = "fv";

DirectorySearcher ds = new DirectorySearcher(de, "cn=fv");

SearchResult sr = ds.FindOne();

DirectoryEntry usr = sr.GetDirectoryEntry();

usr.Invoke("ChangePassword",new object[]{"fv","12345qwert"});

usr.CommitChanges();

}

catch(Exception e)

{

Console.WriteLine(e.Message);

}

I an exception that says "Logon failure: unknown user name or bad

password"

and it seems to me that I have
no way neither to change the password nor to distinguish a wrong

credential

error from a an error due to a disabled account, a password expired.

Do you have any suggestion to solve this problem.

Thanks

Fabrizio

[Fabrizio Viggiani]

Ciao Joe,

What can I use beside NetUserChangePassword?

Fabrizio
"Joe Kaplan (MVP - ADSI)" <jo*************@removethis.accenture.com> wrote
in message news:eA**************@TK2MSFTNGP10.phx.gbl...

SetPassword requires the Reset Password permission which is usually only
given out to Admins and Account Operators. ChangePassword is usually given to regulars users for their own objects.

Unfortunately, ADSI won't let you bind with a user's credentials if they
need to change the password at next login, so I don't think you can use ADSI to do what you want to do.

Joe K.

"Fabrizio" <xx*********************@xxxhotmail.com> wrote in message
news:uY**************@TK2MSFTNGP11.phx.gbl...

Thanks Ben,
If the user must change password at next logon I got the same exception
executing the following line:
SearchResult result = search.FindOne();
otherwise if the user is not forced to change password, I got a
System.UnauthorizedAccessException ("Access is denied.")
executing the following line of code:
objUser.SetPassword("newpassword");

This is different from using only DirectoryEntry:
DirectoryEntry de = new DirectoryEntry();
de.AuthenticationType = AuthenticationTypes.ServerBind |
AuthenticationTypes.Secure;
de.Path = "LDAP://10.0.50.20/cn=fv,cn=users,dc=newtesthp,dc=com";
de.Username = "cn=fv,cn=users,dc=newtesthp,dc=com";
de.Password = "fv";
de.Invoke("changepassword",new object[]{"fv","q1w2q1w2q1"});
de.CommitChanges();
If the user must change password at next logon I always got the same
exception (Logon failure: unknown user name or bad password)
executing the following line:
de.Invoke("changepassword",new object[]{"fv","q1w2q1w2q1"});
otherwise if the user is not forced to change password, I am able to change

the password.

I think that the only solution is,on failure, to try to change the

password

with NetUserChangePassword.
This is not what I liked to do but I don't see any other solution.
What do you think about it?

Fabrizio


"Ben Dewey" <be*******@scientiae.com> wrote in message
news:#b*************@TK2MSFTNGP10.phx.gbl...

Fabrizio,

Try to the usr.Invoke('SetPassword', new object[]{"new password"});

or I actually use:

using System;
using System.DirectoryServices;

using ActiveDs;

public static void ChangePassword(string username, string password)
{
try
{
DirectoryEntry de = new DirectoryEntry(LdapPath, LdapUser,
LdapPassword);
DirectorySearcher search = new DirectorySearcher(de,
"(samAccountName=" + username+ ")");
SearchResult result = search.FindOne();
return new DsUser(result.GetDirectoryEntry());
// Set Password and Enable Account
IADsUser objUser = (IADsUser)user.NativeObject;
objUser.SetPassword(password);
}
catch(Exception exp)
{
throw exp;
}
}

This doesn't require you have know the old password and might help resolve your authetication issues. That is, assuming you are authenticating

to AD successfully. Let me know if this helps. If not, What line are you getting

the error message on.
"Fabrizio" <xx*********************@xxxhotmail.com> wrote in message
news:eL*************@TK2MSFTNGP11.phx.gbl...
> (Sorry for the crosspost, but I really don't know which is the right
> newsgroup!)
> Hi all,
>
> I try to change the password to a user that as to change the

password at > first logon:
> try
>
> {
>
> DirectoryEntry de = new DirectoryEntry();
>
> de.AuthenticationType = AuthenticationTypes.ServerBind |
> AuthenticationTypes.Secure;
>
> de.Path = "LDAP://10.0.50.20/cn=users,dc=newtesthp,dc=com";
>
> de.Username = "cn=fv,cn=users,dc=newtesthp,dc=com";
>
> de.Password = "fv";
>
> DirectorySearcher ds = new DirectorySearcher(de, "cn=fv");
>
> SearchResult sr = ds.FindOne();
>
> DirectoryEntry usr = sr.GetDirectoryEntry();
>
> usr.Invoke("ChangePassword",new object[]{"fv","12345qwert"});
>
> usr.CommitChanges();
>
> }
>
> catch(Exception e)
>
> {
>
> Console.WriteLine(e.Message);
>
> }
>
> I an exception that says "Logon failure: unknown user name or bad
password"
> and it seems to me that I have
> no way neither to change the password nor to distinguish a wrong
credential
> error from a an error due to a disabled account, a password expired.
>
> Do you have any suggestion to solve this problem.
>
> Thanks
>
> Fabrizio
>
>

[Joe Kaplan \(MVP - ADSI\)]

That is a good question. I imagine there is a way to do this through the
SSPI API, but I honestly don't know what you are supposed to do in this case
except actually log into Windows and let it tell you that you have to change
your password.

NetUserChangePassword may be hard to pull off from a web application too due
to the security context requirements.

Maybe someone else has a good idea?

Joe K.

"Fabrizio Viggiani" <xx*********************@xxxhotmail.com> wrote in
message news:40******@usenet01.boi.hp.com...

Ciao Joe,

What can I use beside NetUserChangePassword?

Fabrizio
"Joe Kaplan (MVP - ADSI)" <jo*************@removethis.accenture.com> wrote
in message news:eA**************@TK2MSFTNGP10.phx.gbl...

SetPassword requires the Reset Password permission which is usually only
given out to Admins and Account Operators. ChangePassword is usually

given

to regulars users for their own objects.

Unfortunately, ADSI won't let you bind with a user's credentials if they
need to change the password at next login, so I don't think you can use

ADSI

to do what you want to do.

Joe K.

"Fabrizio" <xx*********************@xxxhotmail.com> wrote in message
news:uY**************@TK2MSFTNGP11.phx.gbl...

Thanks Ben,
If the user must change password at next logon I got the same exception executing the following line:
SearchResult result = search.FindOne();
otherwise if the user is not forced to change password, I got a
System.UnauthorizedAccessException ("Access is denied.")
executing the following line of code:
objUser.SetPassword("newpassword");

This is different from using only DirectoryEntry:
DirectoryEntry de = new DirectoryEntry();
de.AuthenticationType = AuthenticationTypes.ServerBind |
AuthenticationTypes.Secure;
de.Path = "LDAP://10.0.50.20/cn=fv,cn=users,dc=newtesthp,dc=com";
de.Username = "cn=fv,cn=users,dc=newtesthp,dc=com";
de.Password = "fv";
de.Invoke("changepassword",new object[]{"fv","q1w2q1w2q1"});
de.CommitChanges();
If the user must change password at next logon I always got the same
exception (Logon failure: unknown user name or bad password)
executing the following line:
de.Invoke("changepassword",new object[]{"fv","q1w2q1w2q1"});
otherwise if the user is not forced to change password, I am able to

change

the password.

I think that the only solution is,on failure, to try to change the

password

with NetUserChangePassword.
This is not what I liked to do but I don't see any other solution.
What do you think about it?

Fabrizio


"Ben Dewey" <be*******@scientiae.com> wrote in message
news:#b*************@TK2MSFTNGP10.phx.gbl...
> Fabrizio,
>
> Try to the usr.Invoke('SetPassword', new object[]{"new password"});
>
> or I actually use:
>
> using System;
> using System.DirectoryServices;
>
> using ActiveDs;
>
> public static void ChangePassword(string username, string password)
> {
> try
> {
> DirectoryEntry de = new DirectoryEntry(LdapPath, LdapUser,
> LdapPassword);
> DirectorySearcher search = new DirectorySearcher(de,
> "(samAccountName=" + username+ ")");
> SearchResult result = search.FindOne();
> return new DsUser(result.GetDirectoryEntry());
> // Set Password and Enable Account
> IADsUser objUser = (IADsUser)user.NativeObject;
> objUser.SetPassword(password);
> }
> catch(Exception exp)
> {
> throw exp;
> }
> }
>
> This doesn't require you have know the old password and might help

resolve

> your authetication issues. That is, assuming you are authenticating

to

AD

> successfully. Let me know if this helps. If not, What line are you
getting
> the error message on.
>
>
> "Fabrizio" <xx*********************@xxxhotmail.com> wrote in message
> news:eL*************@TK2MSFTNGP11.phx.gbl...
> > (Sorry for the crosspost, but I really don't know which is the right > > newsgroup!)
> > Hi all,
> >
> > I try to change the password to a user that as to change the

password

at

> > first logon:
> > try
> >
> > {
> >
> > DirectoryEntry de = new DirectoryEntry();
> >
> > de.AuthenticationType = AuthenticationTypes.ServerBind |
> > AuthenticationTypes.Secure;
> >
> > de.Path = "LDAP://10.0.50.20/cn=users,dc=newtesthp,dc=com";
> >
> > de.Username = "cn=fv,cn=users,dc=newtesthp,dc=com";
> >
> > de.Password = "fv";
> >
> > DirectorySearcher ds = new DirectorySearcher(de, "cn=fv");
> >
> > SearchResult sr = ds.FindOne();
> >
> > DirectoryEntry usr = sr.GetDirectoryEntry();
> >
> > usr.Invoke("ChangePassword",new object[]{"fv","12345qwert"});
> >
> > usr.CommitChanges();
> >
> > }
> >
> > catch(Exception e)
> >
> > {
> >
> > Console.WriteLine(e.Message);
> >
> > }
> >
> > I an exception that says "Logon failure: unknown user name or bad
> password"
> > and it seems to me that I have
> > no way neither to change the password nor to distinguish a wrong
> credential
> > error from a an error due to a disabled account, a password expired. > >
> > Do you have any suggestion to solve this problem.
> >
> > Thanks
> >
> > Fabrizio
> >
> >
>
>

[Henry]

Forgot to mention, I'm using ADAM here. Anyone?

"Fabrizio" <xx*********************@xxxhotmail.com> wrote in message
news:eL*************@TK2MSFTNGP11.phx.gbl...

(Sorry for the crosspost, but I really don't know which is the right
newsgroup!)
Hi all,

I try to change the password to a user that as to change the password at
first logon:
try

{

DirectoryEntry de = new DirectoryEntry();

de.AuthenticationType = AuthenticationTypes.ServerBind |
AuthenticationTypes.Secure;

de.Path = "LDAP://10.0.50.20/cn=users,dc=newtesthp,dc=com";

de.Username = "cn=fv,cn=users,dc=newtesthp,dc=com";

de.Password = "fv";

DirectorySearcher ds = new DirectorySearcher(de, "cn=fv");

SearchResult sr = ds.FindOne();

DirectoryEntry usr = sr.GetDirectoryEntry();

usr.Invoke("ChangePassword",new object[]{"fv","12345qwert"});

usr.CommitChanges();

}

catch(Exception e)

{

Console.WriteLine(e.Message);

}

I an exception that says "Logon failure: unknown user name or bad password" and it seems to me that I have
no way neither to change the password nor to distinguish a wrong credential error from a an error due to a disabled account, a password expired.

Do you have any suggestion to solve this problem.

Thanks

Fabrizio

[Henry]

Oops sorry.., posted to wrong question.

"Henry" <ig******@hotmail.com> wrote in message
news:uw**************@TK2MSFTNGP10.phx.gbl...

Forgot to mention, I'm using ADAM here. Anyone?

"Fabrizio" <xx*********************@xxxhotmail.com> wrote in message
news:eL*************@TK2MSFTNGP11.phx.gbl...

(Sorry for the crosspost, but I really don't know which is the right
newsgroup!)
Hi all,

I try to change the password to a user that as to change the password at
first logon:
try

{

DirectoryEntry de = new DirectoryEntry();

de.AuthenticationType = AuthenticationTypes.ServerBind |
AuthenticationTypes.Secure;

de.Path = "LDAP://10.0.50.20/cn=users,dc=newtesthp,dc=com";

de.Username = "cn=fv,cn=users,dc=newtesthp,dc=com";

de.Password = "fv";

DirectorySearcher ds = new DirectorySearcher(de, "cn=fv");

SearchResult sr = ds.FindOne();

DirectoryEntry usr = sr.GetDirectoryEntry();

usr.Invoke("ChangePassword",new object[]{"fv","12345qwert"});

usr.CommitChanges();

}

catch(Exception e)

{

Console.WriteLine(e.Message);

}

I an exception that says "Logon failure: unknown user name or bad

password"

and it seems to me that I have
no way neither to change the password nor to distinguish a wrong

credential

error from a an error due to a disabled account, a password expired.

Do you have any suggestion to solve this problem.

Thanks

Fabrizio