(Sorry for the crosspost, but I really don't know which is the right
newsgroup!)
Hi all,

I try to change the password to a user that as to change the password at
first logon:
try

{

DirectoryEntry de = new DirectoryEntry();

de.AuthenticationType = AuthenticationTypes.ServerBind |
AuthenticationTypes.Secure;

de.Path = "LDAP://10.0.50.20/cn=users,dc=newtesthp,dc=com";

de.Username = "cn=fv,cn=users,dc=newtesthp,dc=com";

de.Password = "fv";

DirectorySearcher ds = new DirectorySearcher(de, "cn=fv");

SearchResult sr = ds.FindOne();

DirectoryEntry usr = sr.GetDirectoryEntry();

usr.Invoke("ChangePassword",new object[]{"fv","12345qwert"});

usr.CommitChanges();

}

catch(Exception e)

{

Console.WriteLine(e.Message);

}

I an exception that says "Logon failure: unknown user name or bad password"
and it seems to me that I have
no way neither to change the password nor to distinguish a wrong credential
error from a an error due to a disabled account, a password expired.

Do you have any suggestion to solve this problem.

Thanks

Fabrizio

Fabrizio,

Try to the usr.Invoke('SetPassword', new object[]{"new password"});

or I actually use:

using System;
using System.DirectoryServices;

using ActiveDs;

public static void ChangePassword(string username, string password)
{
try
{
DirectoryEntry de = new DirectoryEntry(LdapPath, LdapUser,
LdapPassword);
DirectorySearcher search = new DirectorySearcher(de,
"(samAccountName=" + username+ ")");
SearchResult result = search.FindOne();
return new DsUser(result.GetDirectoryEntry());
// Set Password and Enable Account
IADsUser objUser = (IADsUser)user.NativeObject;
objUser.SetPassword(password);
}
catch(Exception exp)
{
throw exp;
}
}

This doesn't require you have know the old password and might help resolve
your authetication issues. That is, assuming you are authenticating to AD
successfully. Let me know if this helps. If not, What line are you getting
the error message on.


"Fabrizio" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> (Sorry for the crosspost, but I really don't know which is the right
> newsgroup!)
> Hi all,
>
> I try to change the password to a user that as to change the password at
> first logon:
> try
>
> {
>
> DirectoryEntry de = new DirectoryEntry();
>
> de.AuthenticationType = AuthenticationTypes.ServerBind |
> AuthenticationTypes.Secure;
>
> de.Path = "LDAP://10.0.50.20/cn=users,dc=newtesthp,dc=com";
>
> de.Username = "cn=fv,cn=users,dc=newtesthp,dc=com";
>
> de.Password = "fv";
>
> DirectorySearcher ds = new DirectorySearcher(de, "cn=fv");
>
> SearchResult sr = ds.FindOne();
>
> DirectoryEntry usr = sr.GetDirectoryEntry();
>
> usr.Invoke("ChangePassword",new object[]{"fv","12345qwert"});
>
> usr.CommitChanges();
>
> }
>
> catch(Exception e)
>
> {
>
> Console.WriteLine(e.Message);
>
> }
>
> I an exception that says "Logon failure: unknown user name or bad
password"
> and it seems to me that I have
> no way neither to change the password nor to distinguish a wrong
credential
> error from a an error due to a disabled account, a password expired.
>
> Do you have any suggestion to solve this problem.
>
> Thanks
>
> Fabrizio
>
>

Also, you should really never bind to AD supplying credentials without
adding AuthenticationTypes.Secure to your DirectoryEntry constructor.
Otherwise you are using simple bind and credentials are passed in clear text
over the network.

Additionally, it is always a good idea to call Dispose on all of the
IDisposable S.DS classes, DirectoryEntry, DirectorySearcher and
SearchResultCollection, or they will tend to leak memory. DirectoryEntry is
especially problematic because the Finalize method has a bug where it
doesn't release the underlying COM object (fixed in Whidbey). C# folks can
use the "using" construct.

Joe K.

"Ben Dewey" <(E-Mail Removed)> wrote in message
news:%(E-Mail Removed)...
> Fabrizio,
>
> Try to the usr.Invoke('SetPassword', new object[]{"new password"});
>
> or I actually use:
>
> using System;
> using System.DirectoryServices;
>
> using ActiveDs;
>
> public static void ChangePassword(string username, string password)
> {
> try
> {
> DirectoryEntry de = new DirectoryEntry(LdapPath, LdapUser,
> LdapPassword);
> DirectorySearcher search = new DirectorySearcher(de,
> "(samAccountName=" + username+ ")");
> SearchResult result = search.FindOne();
> return new DsUser(result.GetDirectoryEntry());
> // Set Password and Enable Account
> IADsUser objUser = (IADsUser)user.NativeObject;
> objUser.SetPassword(password);
> }
> catch(Exception exp)
> {
> throw exp;
> }
> }
>
> This doesn't require you have know the old password and might help resolve
> your authetication issues. That is, assuming you are authenticating to AD
> successfully. Let me know if this helps. If not, What line are you
getting
> the error message on.
>
>
> "Fabrizio" <(E-Mail Removed)> wrote in message
> news:(E-Mail Removed)...
> > (Sorry for the crosspost, but I really don't know which is the right
> > newsgroup!)
> > Hi all,
> >
> > I try to change the password to a user that as to change the password at
> > first logon:
> > try
> >
> > {
> >
> > DirectoryEntry de = new DirectoryEntry();
> >
> > de.AuthenticationType = AuthenticationTypes.ServerBind |
> > AuthenticationTypes.Secure;
> >
> > de.Path = "LDAP://10.0.50.20/cn=users,dc=newtesthp,dc=com";
> >
> > de.Username = "cn=fv,cn=users,dc=newtesthp,dc=com";
> >
> > de.Password = "fv";
> >
> > DirectorySearcher ds = new DirectorySearcher(de, "cn=fv");
> >
> > SearchResult sr = ds.FindOne();
> >
> > DirectoryEntry usr = sr.GetDirectoryEntry();
> >
> > usr.Invoke("ChangePassword",new object[]{"fv","12345qwert"});
> >
> > usr.CommitChanges();
> >
> > }
> >
> > catch(Exception e)
> >
> > {
> >
> > Console.WriteLine(e.Message);
> >
> > }
> >
> > I an exception that says "Logon failure: unknown user name or bad
> password"
> > and it seems to me that I have
> > no way neither to change the password nor to distinguish a wrong
> credential
> > error from a an error due to a disabled account, a password expired.
> >
> > Do you have any suggestion to solve this problem.
> >
> > Thanks
> >
> > Fabrizio
> >
> >
>
>

Thanks Ben,
If the user must change password at next logon I got the same exception
executing the following line:
SearchResult result = search.FindOne();
otherwise if the user is not forced to change password, I got a
System.UnauthorizedAccessException ("Access is denied.")
executing the following line of code:
objUser.SetPassword("newpassword");

This is different from using only DirectoryEntry:
DirectoryEntry de = new DirectoryEntry();
de.AuthenticationType = AuthenticationTypes.ServerBind |
AuthenticationTypes.Secure;
de.Path = "LDAP://10.0.50.20/cn=fv,cn=users,dc=newtesthp,dc=com";
de.Username = "cn=fv,cn=users,dc=newtesthp,dc=com";
de.Password = "fv";
de.Invoke("changepassword",new object[]{"fv","q1w2q1w2q1"});
de.CommitChanges();
If the user must change password at next logon I always got the same
exception (Logon failure: unknown user name or bad password)
executing the following line:
de.Invoke("changepassword",new object[]{"fv","q1w2q1w2q1"});
otherwise if the user is not forced to change password, I am able to change
the password.

I think that the only solution is,on failure, to try to change the password
with NetUserChangePassword.
This is not what I liked to do but I don't see any other solution.
What do you think about it?

Fabrizio




"Ben Dewey" <(E-Mail Removed)> wrote in message
news:#(E-Mail Removed)...
> Fabrizio,
>
> Try to the usr.Invoke('SetPassword', new object[]{"new password"});
>
> or I actually use:
>
> using System;
> using System.DirectoryServices;
>
> using ActiveDs;
>
> public static void ChangePassword(string username, string password)
> {
> try
> {
> DirectoryEntry de = new DirectoryEntry(LdapPath, LdapUser,
> LdapPassword);
> DirectorySearcher search = new DirectorySearcher(de,
> "(samAccountName=" + username+ ")");
> SearchResult result = search.FindOne();
> return new DsUser(result.GetDirectoryEntry());
> // Set Password and Enable Account
> IADsUser objUser = (IADsUser)user.NativeObject;
> objUser.SetPassword(password);
> }
> catch(Exception exp)
> {
> throw exp;
> }
> }
>
> This doesn't require you have know the old password and might help resolve
> your authetication issues. That is, assuming you are authenticating to AD
> successfully. Let me know if this helps. If not, What line are you
getting
> the error message on.
>
>
> "Fabrizio" <(E-Mail Removed)> wrote in message
> news:(E-Mail Removed)...
> > (Sorry for the crosspost, but I really don't know which is the right
> > newsgroup!)
> > Hi all,
> >
> > I try to change the password to a user that as to change the password at
> > first logon:
> > try
> >
> > {
> >
> > DirectoryEntry de = new DirectoryEntry();
> >
> > de.AuthenticationType = AuthenticationTypes.ServerBind |
> > AuthenticationTypes.Secure;
> >
> > de.Path = "LDAP://10.0.50.20/cn=users,dc=newtesthp,dc=com";
> >
> > de.Username = "cn=fv,cn=users,dc=newtesthp,dc=com";
> >
> > de.Password = "fv";
> >
> > DirectorySearcher ds = new DirectorySearcher(de, "cn=fv");
> >
> > SearchResult sr = ds.FindOne();
> >
> > DirectoryEntry usr = sr.GetDirectoryEntry();
> >
> > usr.Invoke("ChangePassword",new object[]{"fv","12345qwert"});
> >
> > usr.CommitChanges();
> >
> > }
> >
> > catch(Exception e)
> >
> > {
> >
> > Console.WriteLine(e.Message);
> >
> > }
> >
> > I an exception that says "Logon failure: unknown user name or bad
> password"
> > and it seems to me that I have
> > no way neither to change the password nor to distinguish a wrong
> credential
> > error from a an error due to a disabled account, a password expired.
> >
> > Do you have any suggestion to solve this problem.
> >
> > Thanks
> >
> > Fabrizio
> >
> >
>
>

Joe,

Along these lines, if you are using some ActiveDs Objects in C#, ie. SecUtil
and SecDescp Classes, what is the best way to dispose of them?

"Joe Kaplan (MVP - ADSI)" <(E-Mail Removed)> wrote
in message news:(E-Mail Removed)...
> Also, you should really never bind to AD supplying credentials without
> adding AuthenticationTypes.Secure to your DirectoryEntry constructor.
> Otherwise you are using simple bind and credentials are passed in clear
text
> over the network.
>
> Additionally, it is always a good idea to call Dispose on all of the
> IDisposable S.DS classes, DirectoryEntry, DirectorySearcher and
> SearchResultCollection, or they will tend to leak memory. DirectoryEntry
is
> especially problematic because the Finalize method has a bug where it
> doesn't release the underlying COM object (fixed in Whidbey). C# folks
can
> use the "using" construct.
>
> Joe K.
>
> "Ben Dewey" <(E-Mail Removed)> wrote in message
> news:%(E-Mail Removed)...
> > Fabrizio,
> >
> > Try to the usr.Invoke('SetPassword', new object[]{"new password"});
> >
> > or I actually use:
> >
> > using System;
> > using System.DirectoryServices;
> >
> > using ActiveDs;
> >
> > public static void ChangePassword(string username, string password)
> > {
> > try
> > {
> > DirectoryEntry de = new DirectoryEntry(LdapPath, LdapUser,
> > LdapPassword);
> > DirectorySearcher search = new DirectorySearcher(de,
> > "(samAccountName=" + username+ ")");
> > SearchResult result = search.FindOne();
> > return new DsUser(result.GetDirectoryEntry());
> > // Set Password and Enable Account
> > IADsUser objUser = (IADsUser)user.NativeObject;
> > objUser.SetPassword(password);
> > }
> > catch(Exception exp)
> > {
> > throw exp;
> > }
> > }
> >
> > This doesn't require you have know the old password and might help
resolve
> > your authetication issues. That is, assuming you are authenticating to
AD
> > successfully. Let me know if this helps. If not, What line are you
> getting
> > the error message on.
> >
> >
> > "Fabrizio" <(E-Mail Removed)> wrote in message
> > news:(E-Mail Removed)...
> > > (Sorry for the crosspost, but I really don't know which is the right
> > > newsgroup!)
> > > Hi all,
> > >
> > > I try to change the password to a user that as to change the password
at
> > > first logon:
> > > try
> > >
> > > {
> > >
> > > DirectoryEntry de = new DirectoryEntry();
> > >
> > > de.AuthenticationType = AuthenticationTypes.ServerBind |
> > > AuthenticationTypes.Secure;
> > >
> > > de.Path = "LDAP://10.0.50.20/cn=users,dc=newtesthp,dc=com";
> > >
> > > de.Username = "cn=fv,cn=users,dc=newtesthp,dc=com";
> > >
> > > de.Password = "fv";
> > >
> > > DirectorySearcher ds = new DirectorySearcher(de, "cn=fv");
> > >
> > > SearchResult sr = ds.FindOne();
> > >
> > > DirectoryEntry usr = sr.GetDirectoryEntry();
> > >
> > > usr.Invoke("ChangePassword",new object[]{"fv","12345qwert"});
> > >
> > > usr.CommitChanges();
> > >
> > > }
> > >
> > > catch(Exception e)
> > >
> > > {
> > >
> > > Console.WriteLine(e.Message);
> > >
> > > }
> > >
> > > I an exception that says "Logon failure: unknown user name or bad
> > password"
> > > and it seems to me that I have
> > > no way neither to change the password nor to distinguish a wrong
> > credential
> > > error from a an error due to a disabled account, a password expired.
> > >
> > > Do you have any suggestion to solve this problem.
> > >
> > > Thanks
> > >
> > > Fabrizio
> > >
> > >
> >
> >
>
>

That is a good question which is probably better posed to the interop
newsgroup than anywhere else. My assumption is that that CCW takes care of
that for you, but I don't know for sure.

Joe K.

"Ben Dewey" <(E-Mail Removed)> wrote in message
news:e%(E-Mail Removed)...
> Joe,
>
> Along these lines, if you are using some ActiveDs Objects in C#, ie.
SecUtil
> and SecDescp Classes, what is the best way to dispose of them?
>
> "Joe Kaplan (MVP - ADSI)" <(E-Mail Removed)> wrote
> in message news:(E-Mail Removed)...
> > Also, you should really never bind to AD supplying credentials without
> > adding AuthenticationTypes.Secure to your DirectoryEntry constructor.
> > Otherwise you are using simple bind and credentials are passed in clear
> text
> > over the network.
> >
> > Additionally, it is always a good idea to call Dispose on all of the
> > IDisposable S.DS classes, DirectoryEntry, DirectorySearcher and
> > SearchResultCollection, or they will tend to leak memory.
DirectoryEntry
> is
> > especially problematic because the Finalize method has a bug where it
> > doesn't release the underlying COM object (fixed in Whidbey). C# folks
> can
> > use the "using" construct.
> >
> > Joe K.
> >
> > "Ben Dewey" <(E-Mail Removed)> wrote in message
> > news:%(E-Mail Removed)...
> > > Fabrizio,
> > >
> > > Try to the usr.Invoke('SetPassword', new object[]{"new password"});
> > >
> > > or I actually use:
> > >
> > > using System;
> > > using System.DirectoryServices;
> > >
> > > using ActiveDs;
> > >
> > > public static void ChangePassword(string username, string password)
> > > {
> > > try
> > > {
> > > DirectoryEntry de = new DirectoryEntry(LdapPath, LdapUser,
> > > LdapPassword);
> > > DirectorySearcher search = new DirectorySearcher(de,
> > > "(samAccountName=" + username+ ")");
> > > SearchResult result = search.FindOne();
> > > return new DsUser(result.GetDirectoryEntry());
> > > // Set Password and Enable Account
> > > IADsUser objUser = (IADsUser)user.NativeObject;
> > > objUser.SetPassword(password);
> > > }
> > > catch(Exception exp)
> > > {
> > > throw exp;
> > > }
> > > }
> > >
> > > This doesn't require you have know the old password and might help
> resolve
> > > your authetication issues. That is, assuming you are authenticating
to
> AD
> > > successfully. Let me know if this helps. If not, What line are you
> > getting
> > > the error message on.
> > >
> > >
> > > "Fabrizio" <(E-Mail Removed)> wrote in message
> > > news:(E-Mail Removed)...
> > > > (Sorry for the crosspost, but I really don't know which is the right
> > > > newsgroup!)
> > > > Hi all,
> > > >
> > > > I try to change the password to a user that as to change the
password
> at
> > > > first logon:
> > > > try
> > > >
> > > > {
> > > >
> > > > DirectoryEntry de = new DirectoryEntry();
> > > >
> > > > de.AuthenticationType = AuthenticationTypes.ServerBind |
> > > > AuthenticationTypes.Secure;
> > > >
> > > > de.Path = "LDAP://10.0.50.20/cn=users,dc=newtesthp,dc=com";
> > > >
> > > > de.Username = "cn=fv,cn=users,dc=newtesthp,dc=com";
> > > >
> > > > de.Password = "fv";
> > > >
> > > > DirectorySearcher ds = new DirectorySearcher(de, "cn=fv");
> > > >
> > > > SearchResult sr = ds.FindOne();
> > > >
> > > > DirectoryEntry usr = sr.GetDirectoryEntry();
> > > >
> > > > usr.Invoke("ChangePassword",new object[]{"fv","12345qwert"});
> > > >
> > > > usr.CommitChanges();
> > > >
> > > > }
> > > >
> > > > catch(Exception e)
> > > >
> > > > {
> > > >
> > > > Console.WriteLine(e.Message);
> > > >
> > > > }
> > > >
> > > > I an exception that says "Logon failure: unknown user name or bad
> > > password"
> > > > and it seems to me that I have
> > > > no way neither to change the password nor to distinguish a wrong
> > > credential
> > > > error from a an error due to a disabled account, a password expired.
> > > >
> > > > Do you have any suggestion to solve this problem.
> > > >
> > > > Thanks
> > > >
> > > > Fabrizio
> > > >
> > > >
> > >
> > >
> >
> >
>
>

SetPassword requires the Reset Password permission which is usually only
given out to Admins and Account Operators. ChangePassword is usually given
to regulars users for their own objects.

Unfortunately, ADSI won't let you bind with a user's credentials if they
need to change the password at next login, so I don't think you can use ADSI
to do what you want to do.

Joe K.

"Fabrizio" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> Thanks Ben,
> If the user must change password at next logon I got the same exception
> executing the following line:
> SearchResult result = search.FindOne();
> otherwise if the user is not forced to change password, I got a
> System.UnauthorizedAccessException ("Access is denied.")
> executing the following line of code:
> objUser.SetPassword("newpassword");
>
> This is different from using only DirectoryEntry:
> DirectoryEntry de = new DirectoryEntry();
> de.AuthenticationType = AuthenticationTypes.ServerBind |
> AuthenticationTypes.Secure;
> de.Path = "LDAP://10.0.50.20/cn=fv,cn=users,dc=newtesthp,dc=com";
> de.Username = "cn=fv,cn=users,dc=newtesthp,dc=com";
> de.Password = "fv";
> de.Invoke("changepassword",new object[]{"fv","q1w2q1w2q1"});
> de.CommitChanges();
> If the user must change password at next logon I always got the same
> exception (Logon failure: unknown user name or bad password)
> executing the following line:
> de.Invoke("changepassword",new object[]{"fv","q1w2q1w2q1"});
> otherwise if the user is not forced to change password, I am able to
change
> the password.
>
> I think that the only solution is,on failure, to try to change the
password
> with NetUserChangePassword.
> This is not what I liked to do but I don't see any other solution.
> What do you think about it?
>
> Fabrizio
>
>
>
>
> "Ben Dewey" <(E-Mail Removed)> wrote in message
> news:#(E-Mail Removed)...
> > Fabrizio,
> >
> > Try to the usr.Invoke('SetPassword', new object[]{"new password"});
> >
> > or I actually use:
> >
> > using System;
> > using System.DirectoryServices;
> >
> > using ActiveDs;
> >
> > public static void ChangePassword(string username, string password)
> > {
> > try
> > {
> > DirectoryEntry de = new DirectoryEntry(LdapPath, LdapUser,
> > LdapPassword);
> > DirectorySearcher search = new DirectorySearcher(de,
> > "(samAccountName=" + username+ ")");
> > SearchResult result = search.FindOne();
> > return new DsUser(result.GetDirectoryEntry());
> > // Set Password and Enable Account
> > IADsUser objUser = (IADsUser)user.NativeObject;
> > objUser.SetPassword(password);
> > }
> > catch(Exception exp)
> > {
> > throw exp;
> > }
> > }
> >
> > This doesn't require you have know the old password and might help
resolve
> > your authetication issues. That is, assuming you are authenticating to
AD
> > successfully. Let me know if this helps. If not, What line are you
> getting
> > the error message on.
> >
> >
> > "Fabrizio" <(E-Mail Removed)> wrote in message
> > news:(E-Mail Removed)...
> > > (Sorry for the crosspost, but I really don't know which is the right
> > > newsgroup!)
> > > Hi all,
> > >
> > > I try to change the password to a user that as to change the password
at
> > > first logon:
> > > try
> > >
> > > {
> > >
> > > DirectoryEntry de = new DirectoryEntry();
> > >
> > > de.AuthenticationType = AuthenticationTypes.ServerBind |
> > > AuthenticationTypes.Secure;
> > >
> > > de.Path = "LDAP://10.0.50.20/cn=users,dc=newtesthp,dc=com";
> > >
> > > de.Username = "cn=fv,cn=users,dc=newtesthp,dc=com";
> > >
> > > de.Password = "fv";
> > >
> > > DirectorySearcher ds = new DirectorySearcher(de, "cn=fv");
> > >
> > > SearchResult sr = ds.FindOne();
> > >
> > > DirectoryEntry usr = sr.GetDirectoryEntry();
> > >
> > > usr.Invoke("ChangePassword",new object[]{"fv","12345qwert"});
> > >
> > > usr.CommitChanges();
> > >
> > > }
> > >
> > > catch(Exception e)
> > >
> > > {
> > >
> > > Console.WriteLine(e.Message);
> > >
> > > }
> > >
> > > I an exception that says "Logon failure: unknown user name or bad
> > password"
> > > and it seems to me that I have
> > > no way neither to change the password nor to distinguish a wrong
> > credential
> > > error from a an error due to a disabled account, a password expired.
> > >
> > > Do you have any suggestion to solve this problem.
> > >
> > > Thanks
> > >
> > > Fabrizio
> > >
> > >
> >
> >
>
>

Ciao Joe,

What can I use beside NetUserChangePassword?

Fabrizio


"Joe Kaplan (MVP - ADSI)" <(E-Mail Removed)> wrote
in message news:(E-Mail Removed)...
> SetPassword requires the Reset Password permission which is usually only
> given out to Admins and Account Operators. ChangePassword is usually
given
> to regulars users for their own objects.
>
> Unfortunately, ADSI won't let you bind with a user's credentials if they
> need to change the password at next login, so I don't think you can use
ADSI
> to do what you want to do.
>
> Joe K.
>
> "Fabrizio" <(E-Mail Removed)> wrote in message
> news:(E-Mail Removed)...
> > Thanks Ben,
> > If the user must change password at next logon I got the same exception
> > executing the following line:
> > SearchResult result = search.FindOne();
> > otherwise if the user is not forced to change password, I got a
> > System.UnauthorizedAccessException ("Access is denied.")
> > executing the following line of code:
> > objUser.SetPassword("newpassword");
> >
> > This is different from using only DirectoryEntry:
> > DirectoryEntry de = new DirectoryEntry();
> > de.AuthenticationType = AuthenticationTypes.ServerBind |
> > AuthenticationTypes.Secure;
> > de.Path = "LDAP://10.0.50.20/cn=fv,cn=users,dc=newtesthp,dc=com";
> > de.Username = "cn=fv,cn=users,dc=newtesthp,dc=com";
> > de.Password = "fv";
> > de.Invoke("changepassword",new object[]{"fv","q1w2q1w2q1"});
> > de.CommitChanges();
> > If the user must change password at next logon I always got the same
> > exception (Logon failure: unknown user name or bad password)
> > executing the following line:
> > de.Invoke("changepassword",new object[]{"fv","q1w2q1w2q1"});
> > otherwise if the user is not forced to change password, I am able to
> change
> > the password.
> >
> > I think that the only solution is,on failure, to try to change the
> password
> > with NetUserChangePassword.
> > This is not what I liked to do but I don't see any other solution.
> > What do you think about it?
> >
> > Fabrizio
> >
> >
> >
> >
> > "Ben Dewey" <(E-Mail Removed)> wrote in message
> > news:#(E-Mail Removed)...
> > > Fabrizio,
> > >
> > > Try to the usr.Invoke('SetPassword', new object[]{"new password"});
> > >
> > > or I actually use:
> > >
> > > using System;
> > > using System.DirectoryServices;
> > >
> > > using ActiveDs;
> > >
> > > public static void ChangePassword(string username, string password)
> > > {
> > > try
> > > {
> > > DirectoryEntry de = new DirectoryEntry(LdapPath, LdapUser,
> > > LdapPassword);
> > > DirectorySearcher search = new DirectorySearcher(de,
> > > "(samAccountName=" + username+ ")");
> > > SearchResult result = search.FindOne();
> > > return new DsUser(result.GetDirectoryEntry());
> > > // Set Password and Enable Account
> > > IADsUser objUser = (IADsUser)user.NativeObject;
> > > objUser.SetPassword(password);
> > > }
> > > catch(Exception exp)
> > > {
> > > throw exp;
> > > }
> > > }
> > >
> > > This doesn't require you have know the old password and might help
> resolve
> > > your authetication issues. That is, assuming you are authenticating
to
> AD
> > > successfully. Let me know if this helps. If not, What line are you
> > getting
> > > the error message on.
> > >
> > >
> > > "Fabrizio" <(E-Mail Removed)> wrote in message
> > > news:(E-Mail Removed)...
> > > > (Sorry for the crosspost, but I really don't know which is the right
> > > > newsgroup!)
> > > > Hi all,
> > > >
> > > > I try to change the password to a user that as to change the
password
> at
> > > > first logon:
> > > > try
> > > >
> > > > {
> > > >
> > > > DirectoryEntry de = new DirectoryEntry();
> > > >
> > > > de.AuthenticationType = AuthenticationTypes.ServerBind |
> > > > AuthenticationTypes.Secure;
> > > >
> > > > de.Path = "LDAP://10.0.50.20/cn=users,dc=newtesthp,dc=com";
> > > >
> > > > de.Username = "cn=fv,cn=users,dc=newtesthp,dc=com";
> > > >
> > > > de.Password = "fv";
> > > >
> > > > DirectorySearcher ds = new DirectorySearcher(de, "cn=fv");
> > > >
> > > > SearchResult sr = ds.FindOne();
> > > >
> > > > DirectoryEntry usr = sr.GetDirectoryEntry();
> > > >
> > > > usr.Invoke("ChangePassword",new object[]{"fv","12345qwert"});
> > > >
> > > > usr.CommitChanges();
> > > >
> > > > }
> > > >
> > > > catch(Exception e)
> > > >
> > > > {
> > > >
> > > > Console.WriteLine(e.Message);
> > > >
> > > > }
> > > >
> > > > I an exception that says "Logon failure: unknown user name or bad
> > > password"
> > > > and it seems to me that I have
> > > > no way neither to change the password nor to distinguish a wrong
> > > credential
> > > > error from a an error due to a disabled account, a password expired.
> > > >
> > > > Do you have any suggestion to solve this problem.
> > > >
> > > > Thanks
> > > >
> > > > Fabrizio
> > > >
> > > >
> > >
> > >
> >
> >
>
>

That is a good question. I imagine there is a way to do this through the
SSPI API, but I honestly don't know what you are supposed to do in this case
except actually log into Windows and let it tell you that you have to change
your password.

NetUserChangePassword may be hard to pull off from a web application too due
to the security context requirements.

Maybe someone else has a good idea?

Joe K.

"Fabrizio Viggiani" <(E-Mail Removed)> wrote in
message news:(E-Mail Removed)...
> Ciao Joe,
>
> What can I use beside NetUserChangePassword?
>
> Fabrizio
>
>
> "Joe Kaplan (MVP - ADSI)" <(E-Mail Removed)> wrote
> in message news:(E-Mail Removed)...
> > SetPassword requires the Reset Password permission which is usually only
> > given out to Admins and Account Operators. ChangePassword is usually
> given
> > to regulars users for their own objects.
> >
> > Unfortunately, ADSI won't let you bind with a user's credentials if they
> > need to change the password at next login, so I don't think you can use
> ADSI
> > to do what you want to do.
> >
> > Joe K.
> >
> > "Fabrizio" <(E-Mail Removed)> wrote in message
> > news:(E-Mail Removed)...
> > > Thanks Ben,
> > > If the user must change password at next logon I got the same
exception
> > > executing the following line:
> > > SearchResult result = search.FindOne();
> > > otherwise if the user is not forced to change password, I got a
> > > System.UnauthorizedAccessException ("Access is denied.")
> > > executing the following line of code:
> > > objUser.SetPassword("newpassword");
> > >
> > > This is different from using only DirectoryEntry:
> > > DirectoryEntry de = new DirectoryEntry();
> > > de.AuthenticationType = AuthenticationTypes.ServerBind |
> > > AuthenticationTypes.Secure;
> > > de.Path = "LDAP://10.0.50.20/cn=fv,cn=users,dc=newtesthp,dc=com";
> > > de.Username = "cn=fv,cn=users,dc=newtesthp,dc=com";
> > > de.Password = "fv";
> > > de.Invoke("changepassword",new object[]{"fv","q1w2q1w2q1"});
> > > de.CommitChanges();
> > > If the user must change password at next logon I always got the same
> > > exception (Logon failure: unknown user name or bad password)
> > > executing the following line:
> > > de.Invoke("changepassword",new object[]{"fv","q1w2q1w2q1"});
> > > otherwise if the user is not forced to change password, I am able to
> > change
> > > the password.
> > >
> > > I think that the only solution is,on failure, to try to change the
> > password
> > > with NetUserChangePassword.
> > > This is not what I liked to do but I don't see any other solution.
> > > What do you think about it?
> > >
> > > Fabrizio
> > >
> > >
> > >
> > >
> > > "Ben Dewey" <(E-Mail Removed)> wrote in message
> > > news:#(E-Mail Removed)...
> > > > Fabrizio,
> > > >
> > > > Try to the usr.Invoke('SetPassword', new object[]{"new password"});
> > > >
> > > > or I actually use:
> > > >
> > > > using System;
> > > > using System.DirectoryServices;
> > > >
> > > > using ActiveDs;
> > > >
> > > > public static void ChangePassword(string username, string password)
> > > > {
> > > > try
> > > > {
> > > > DirectoryEntry de = new DirectoryEntry(LdapPath, LdapUser,
> > > > LdapPassword);
> > > > DirectorySearcher search = new DirectorySearcher(de,
> > > > "(samAccountName=" + username+ ")");
> > > > SearchResult result = search.FindOne();
> > > > return new DsUser(result.GetDirectoryEntry());
> > > > // Set Password and Enable Account
> > > > IADsUser objUser = (IADsUser)user.NativeObject;
> > > > objUser.SetPassword(password);
> > > > }
> > > > catch(Exception exp)
> > > > {
> > > > throw exp;
> > > > }
> > > > }
> > > >
> > > > This doesn't require you have know the old password and might help
> > resolve
> > > > your authetication issues. That is, assuming you are authenticating
> to
> > AD
> > > > successfully. Let me know if this helps. If not, What line are you
> > > getting
> > > > the error message on.
> > > >
> > > >
> > > > "Fabrizio" <(E-Mail Removed)> wrote in message
> > > > news:(E-Mail Removed)...
> > > > > (Sorry for the crosspost, but I really don't know which is the
right
> > > > > newsgroup!)
> > > > > Hi all,
> > > > >
> > > > > I try to change the password to a user that as to change the
> password
> > at
> > > > > first logon:
> > > > > try
> > > > >
> > > > > {
> > > > >
> > > > > DirectoryEntry de = new DirectoryEntry();
> > > > >
> > > > > de.AuthenticationType = AuthenticationTypes.ServerBind |
> > > > > AuthenticationTypes.Secure;
> > > > >
> > > > > de.Path = "LDAP://10.0.50.20/cn=users,dc=newtesthp,dc=com";
> > > > >
> > > > > de.Username = "cn=fv,cn=users,dc=newtesthp,dc=com";
> > > > >
> > > > > de.Password = "fv";
> > > > >
> > > > > DirectorySearcher ds = new DirectorySearcher(de, "cn=fv");
> > > > >
> > > > > SearchResult sr = ds.FindOne();
> > > > >
> > > > > DirectoryEntry usr = sr.GetDirectoryEntry();
> > > > >
> > > > > usr.Invoke("ChangePassword",new object[]{"fv","12345qwert"});
> > > > >
> > > > > usr.CommitChanges();
> > > > >
> > > > > }
> > > > >
> > > > > catch(Exception e)
> > > > >
> > > > > {
> > > > >
> > > > > Console.WriteLine(e.Message);
> > > > >
> > > > > }
> > > > >
> > > > > I an exception that says "Logon failure: unknown user name or bad
> > > > password"
> > > > > and it seems to me that I have
> > > > > no way neither to change the password nor to distinguish a wrong
> > > > credential
> > > > > error from a an error due to a disabled account, a password
expired.
> > > > >
> > > > > Do you have any suggestion to solve this problem.
> > > > >
> > > > > Thanks
> > > > >
> > > > > Fabrizio
> > > > >
> > > > >
> > > >
> > > >
> > >
> > >
> >
> >
>
>

Forgot to mention, I'm using ADAM here. Anyone?

"Fabrizio" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> (Sorry for the crosspost, but I really don't know which is the right
> newsgroup!)
> Hi all,
>
> I try to change the password to a user that as to change the password at
> first logon:
> try
>
> {
>
> DirectoryEntry de = new DirectoryEntry();
>
> de.AuthenticationType = AuthenticationTypes.ServerBind |
> AuthenticationTypes.Secure;
>
> de.Path = "LDAP://10.0.50.20/cn=users,dc=newtesthp,dc=com";
>
> de.Username = "cn=fv,cn=users,dc=newtesthp,dc=com";
>
> de.Password = "fv";
>
> DirectorySearcher ds = new DirectorySearcher(de, "cn=fv");
>
> SearchResult sr = ds.FindOne();
>
> DirectoryEntry usr = sr.GetDirectoryEntry();
>
> usr.Invoke("ChangePassword",new object[]{"fv","12345qwert"});
>
> usr.CommitChanges();
>
> }
>
> catch(Exception e)
>
> {
>
> Console.WriteLine(e.Message);
>
> }
>
> I an exception that says "Logon failure: unknown user name or bad
password"
> and it seems to me that I have
> no way neither to change the password nor to distinguish a wrong
credential
> error from a an error due to a disabled account, a password expired.
>
> Do you have any suggestion to solve this problem.
>
> Thanks
>
> Fabrizio
>
>