3

We have a computer running Windows Server 2012 R2, which is not member of any domain, and a web application running on this server. Users of the application are set up as local Windows users of the server. But users never log into the server themselves, the application just asks them for user name and password, and then checks against the server if the password is correct.

The application is requested to allow users to change their password. I tried to use the ADSI interface method ChangePassword(oldPassword, newPassword) to do that. Alternatively, the ADSI method SetPassword(newPassword). But I got an error message "Access is denied".

I think, according to https://msdn.microsoft.com/en-us/library/ms180915(v=vs.90).aspx, I need to add ACEs (AccessControlEntries) containing the following extended rights to the ACL (AccessControlList) of the user executing the service accessed via the Web:

  • Reset Password and
  • Change Password

for the methods having a similar same name. These are described here. All tools that I found that would allow me to seet these ("Active Directory users and Computers", "ADSI Edit", or "dsacls"), do require an Active Directory to connect to before doing anything.

And all code samples I found, require an Active Directory as well in order to get to the user or group object for which the ACL needs to be changed.

My experimenting shows that I can make the account a member of the Administrators group, which seems to have the SetPassword permission. But probably that is much more than needed, and I would like to only give as much permission to the account as required. And I still would not be able to verify the old password this way.

Is there no way to simply add an ACE to a user account if the user is a local user and not an AD user?

0

You must log in to answer this question.

Browse other questions tagged .