Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My question is how ADSI performs SetPassword operation. According to what I have read ADSI is a COM interface and it has more capabilities than AD provides through LDAP. While you are suppose to update unicodePwd attribute of a personaccount entity through LDAP, ADSI provides you SetPassword call. I know that ADSI & AD provides Kerberos during authentication. So how the password is transmitted to server when SetPassword is called? Is it raw binary unencrypted data? Or does Kerberos comes into play at this call?

share|improve this question

1 Answer 1

up vote 0 down vote accepted

The netlogon service changes the password over RPC, usually contacting the PDC emulator directly.

Check this to see how the session is established: http://msdn.microsoft.com/en-us/library/cc208245%28v=prot.10%29.aspx

So no, the password is not sent in clear text over the wire. It could be sniffed locally on the DC that is on the receiving end however. Some password sync tools work like that, actually.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.