Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm wondering what format I need to put hashes in to write to userPassword via LDAP. Apache Directory Studio gives me several options, but I don't think any of them are it. Can anyone document the proper encoding and algorithms used by default for AD 2003r2?

share|improve this question

2 Answers 2

up vote 10 down vote accepted

You can't write password hashes into the Active Directory via LDAP. You can update the "unicodePwd" attribute via LDAP over SSL. (If you're not using SSL you'll get back a "The server is unwilling to process the request." error 0x80072035).

There's no "supported" mechanism for writing raw hashes into the Directory, though.

share|improve this answer

This KB article indicates that you can write the password as a unicode octet-string (of the plaintext password) to a user's unicodePwd attribute. It's described for Windows 2000, but as far as I know this hasn't changed.

This blog post includes a Perl script which implements the process, and which you can look to for more details. Here's another example in Java.

I think the userPassword attribute is an alias for unicodePwd, but I don't actually know if that's true.

Note: You must use an SSL connection to LDAP to update a user's password; AD will not permit password updates over an unencrypted channel.

share|improve this answer
    
While correct, managing with Powershell is much easier than Perl or Java Scripts. –  Cheekaleak Jun 7 '11 at 3:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.