Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to build a self-service password reset tool for a test domain. I am using ASP.NET 4 and IIS 7.

My code:

string userDirectoryEntry = "WinNT://domain/" + usermapping[user[1]]
System.DirectoryServices.DirectoryEntry ADEntryToReset = new System.DirectoryServices.DirectoryEntry(userDirectoryEntry);

ADEntryToReset.Invoke("SetPassword", new object[] { newPassword });
ADEntryToReset.Properties["passwordExpired"][0] = 1;
ADEntryToReset.CommitChanges();

However I am getting access denied when committing the password change. I have changed the Default App Pool to run under an admin account that can change passwords. Works fine in the Visual Studio debugger.

I have also tried explicitly supplying credentials to the DirectoryEntry object (msdn). This also does not work.

Any ideas?

share|improve this question
    
What happens when you use LDAP: instead of WinNT:? Also, can you perform another activity such as modifying an attribute? –  Greg Askew Jan 17 '13 at 1:41
add comment

1 Answer 1

You might want to use the LDAP provider instead of the pre-2000 WinNT provider, which has some capability limitations compared to LDAP. The userDirectoryEntry string should begin with LDAP:// instead of WinNT://

If the msdn example with credentials doesn't work, try initializing the DirectoryEntry object with the credentials:

new DirectoryEntry(userDN,callerUsername,callerPwd);

http://msdn.microsoft.com/en-us/library/wh2h7eed.aspx

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.