2

I can connect with a user who has permissions to set passwords. I'm able to change attributes, but I can't set the password.

Found some instructions to set the attribute unicodePwd to \UNC:"password", but it says:

Error: Modify: Unwilling To Perform. <53>

Setting LDAP_OPT_ENCRYPT to 1 didn't work either. The port I'm using is 389.

Note: this is a repost of a question from stackoverflow, so please go and vote to close the original.

1
  • Is there some reason you're trying to reset a password in such an exotic manner? Why not use the AD Users & Computers console? Jun 1, 2009 at 21:27

4 Answers 4

1

You would use the userPassword attribute. Why are you using port 389, though? You wouldn't want to send a password change in clear text. I also don't believe AD will allow you to change a password via LDAP without an SSL connection.

2

Sam Cogan is correct. Use the other attribute. Here's a [technet article describing how to do it](http://technet.microsoft.com/en-us/library/cc731012(WS.10).aspx).

2

To set unicodePwd directly using ldp.exe set LDAP_OPT_ENCRYPT = 1 to bind with an encrypted channel and use this syntax:

\UNI:"pwdhere"

The \UNI: and the quotes are very important as the password must be passed in Unicode and the quotes are used by the system to delimit the password.

You also need Reset Password permission if you want to replace the existing password and Change Password permissions to do a remove and add operation.

From here: http://microsoft.public.windows.server.active-directory.narkive.com/tBRamxYg/reset-password-problem

1

I believe you should be using the userpassword attribute rather than the unicodePWD attribute. UserPassword is a writeable alias for unicodePWD.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .