Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm configuring a Zentyal box as a gateway. For Proxy authentication i'm trying to synchronize Zentyal with an AD vía LDAP according to Zentyal's documentations http://doc.zentyal.org/en/directory.html#configuring-zentyal-as-a-slave-of-windows-active-directory

The problem is Zentyal only can synchronize a user when it's new or when their password is changed.

Anyone know hoy can i made a massive (fake) password change reading a user password and reset it with the same string? Or there's a way to get all the user passwords to make the resets by hand?

Anyone have an alternative solution for this?

Thanks

share|improve this question
    
are you trying to sync your passwords through a firewall to an external facing server? –  Jim B May 20 '11 at 13:20

1 Answer 1

up vote 3 down vote accepted

I had a paragraph typed up about changing the pwdLastSet attribute to trick AD into thinking that the password was recently changed..

But that's not what you need. What the application seems to need is to have the password changed once a password filter has been installed on the domain controller that will send a copy of the password over to the application.

So - what you're looking for isn't possible. The cryptographic transform used to store an AD password is not reversible; it cannot be retrieved once stored. Tools are available to attack those stored hashes, but they will not reliably retrieve all of your users' passwords (unless they all use weak passwords). The other option is to use the "reversible encryption" mode, which won't do you any good unless it's already enabled.

Your best bet is to install the password filter so that updates are making it to the application, then modify your group policy password settings to have all your users' passwords to expire in the next week or two.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.