Active Directory-ChangePassword

[sreenathk]

Hi,


I am using the below code to change the password. It gives me an error

Exception has been thrown by the target of an invocation. Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))

I Checked the active directory server and everything looks fine(all permissions to change the password is set ) . I am able to login to the server but I am not able to do any other operations ..

Any ideas would be appreciated.


DirectoryEntry de = new DirectoryEntry("LDAP://abc.xyz.net", txtUserName.Text, txtPassword.Text);

DirectorySearcher deSearch = new DirectorySearcher();

deSearch.SearchRoot=de;

// Filter based on the user Account.

deSearch.Filter = "(&(objectClass=user)(sAMAccountName=" + txtUserName.Text + "))";

deSearch.SearchScope = SearchScope.Subtree;

//if there is any records for the user under the active directory

SearchResult results= deSearch.FindOne();

if(results!=null)

{

de = new DirectoryEntry(results.Path, txtUserName.Text, txtPassword.Text, AuthenticationTypes.Secure);

//ChangePassword is one of the methods used when calling Invoke

de.Invoke("ChangePassword", new Object[] { txtPassword.Text, txtConfirmNewPwd.Text });

//Commit the changes to the active directory

de.CommitChanges();

lblErrorMsg.Text = "Password Changed";

}



Thanks
Sree

[wwb_99]

You have permissions to change passwords, but does the context which the program is running have permissions to change passwords?

[sreenathk]

How can I check that ?? I am not sure about that...

We are using IIS6.0 which connects to an active directory server which is on DMZ.

web.config has the following.

<authentication mode="Forms">
<forms loginUrl="AdminLogin.aspx" name="adAuthCookie" timeout="60" path="/" ></forms>
</authentication>
<authorization>
<deny users="?"/>
<allow users="*"/>
</authorization>
<identity impersonate="false"/>

Thanks,
Sree

[wwb_99]

You need to run the site in an application pool with appropriate AD permissions to change stuff in AD. Of course, you should be certain that unauthorized users cannot access the app as they can then change stuff in active directory.

[sreenathk]

Thank you very much.

Let me suggest this to the IIS Team and see if they can come up with something.

Regards,
Sree