如何使用 C# .NET 跨域设置/更改 Active Directory 用户密码？

Question

I have been searching around for quite some time now how to set/change a password and revoke/restore a user but have yet to find a solution that actually works for me.

I am beginning to lean towards the fact that I am crossing domains as the problem, even though I can programmatically create/delete/update and even connect/disconnect users from groups.

Basically, I've tried the following ways:

DirectoryEntry account = new DirectoryEntry("LDAP://" + adHostname + "/" + dn, adUserName, adPassword);

account.Invoke("SetPassword", "Password1");
account.Properties["LockOutTime"].Value = 0;
account.CommitChanges();

And also

account.Invoke("SetPassword", new object[] { "Password1" });

They both ultimately throw the error "One or more input parameters are invalid\\r\\n"

I then have tried to use the .NET 3.5 approach using principal context.

using (var context = new PrincipalContext(ContextType.Domain, adHostname, myContainer, ContextOptions.SimpleBind, adUserName, adPassword))
    {
        using (var user = UserPrincipal.FindByIdentity(context, account.Properties["sAMAccountName"].Value.ToString()))
        {
             user.SetPassword(password);
        }
    }    

This approach is also throwing the same error as above. If I switch some things around (I can't seem to remember all the combinations I've tried), it will sometimes throw a "Local error has occurred" COM Exception.

Any help is much appreciated.

---

## EDIT WITH WORKING SOLUTION ##

using System.DirectoryServices.Protocols;

LdapDirectoryIdentifier identifier = new LdapDirectoryIdentifier(_adHostname, 636);
NetworkCredential credential = new NetworkCredential(_adUserName, _adPassword);

string password = "MyRandomComplexPassword";


using (LdapConnection connection = new LdapConnection(identifier, credential))
{
    connection.SessionOptions.SecureSocketLayer = true;
    connection.SessionOptions.VerifyServerCertificate += delegate { return true; };
    connection.AuthType = AuthType.Basic;
    connection.Bind(credential);

    DirectoryAttributeModification modPwd = new DirectoryAttributeModification();
    modPwd.Operation = DirectoryAttributeOperation.Replace;
    modPwd.Name = "unicodePwd";
    modPwd.Add(Encoding.Unicode.GetBytes("\"" + password + "\""));

    DirectoryAttributeModification[] dMods = new DirectoryAttributeModification[1];
    dMods[0] = modPwd;

    ModifyRequest modReq = new ModifyRequest(accountDN, dMods);

    DirectoryResponse pwdModResponse;
    pwdModResponse = connection.SendRequest(modReq);    
}

Answer 1

"new DirectoryEntry" does not bind the user account. The user needs to be searched out for setting password. Like this:

DirectoryEntry account = new DirectoryEntry("LDAP://" + adHostname + "/" + dn, null, null, AuthenticationTypes.Secure | AuthenticationTypes.Sealing | AuthenticationTypes.Signing);

DirectorySearcher search = new DirectorySearcher(account);
search.Filter = "(&(objectClass=user)(sAMAccountName=" + adUserName + "))";
account = search.FindOne().GetDirectoryEntry();

account.Invoke("SetPassword", "Password1");
account.Properties["LockOutTime"].Value = 0;
account.CommitChanges();

Answer 2

This one always works for me. Hope it helps. First add reference to System.DirectoryServices.AccountManagement

    string hostName = "myDomain";
    string adminName = "admin";
    string adminPassword = "password";

    public static void ResetPassword(string username, string password)
            {
        using (PrincipalContext pContext = new PrincipalContext(ContextType.Domain, hostName, adminName, adminPassword))
                                {
                                    UserPrincipal up = UserPrincipal.FindByIdentity(pContext, username);
                                    if (up != null)
                                    {
                                        up.SetPassword(password);
                                        up.Save();
                                    }
                                }
                        }

You can also do all sort of things to UserPrincipal like lock account, expire password, get last logon, etc.

Answer 3

See this article: https://www.codeproject.com/Articles/18102/Howto-Almost-Everything-In-Active-Directory-via-C#7

You'll notice in all the samples that we're binding directly to the directoryEntry and not specifying a server or credentials. If you do not want to use an impersonation class you can send credentials directly into the DirectoryEntry constructor. The impersonation class is helpful for those times when you want to use a static method and don't want to go through the trouble of creating a DirectoryContext object to hold these details. Likewise you may want to target a specific domain controller.

Target Specific Domain Controllers or Credentials

Everywhere in the code that you see: LDAP:// you can replace with LDAP://MyDomainControllerNameOrIpAddress as well as everywhere you see a DirectoryEntry class being constructed you can send in specific credentials as well. This is especially helpful if you need to work on an Active Directory for which your machine is not a member of it's forest or domain or you want to target a DC to make the changes to.

//Rename an object and specify the domain controller and credentials directly

public static void Rename(string server,
    string userName, string password, string objectDn, string newName)
{
    DirectoryEntry child = new DirectoryEntry("LDAP://" + server + "/" + 
        objectDn, userName, password);
    child.Rename("CN=" + newName);
}

Answer 4

Good afternoon! I have read your question several times but I definitely do not understand the essence of your problem ...

If you need to change your password, first read the materials: https://docs.microsoft.com/en-us/windows/win32/api/iads/nf-iads-iadsuser-setpassword https://docs.microsoft.com/ru-ru/office/client-developer/outlook/mapi/hresult And keep in mind that when you change your password, your account (on behalf of which you will attempt to change your password) must have sufficient administrative privileges in the Active Directory domain to change your password! It is especially important to note that the new password must meet the requirements set by your domain's policies!

        string distinguishedName = $"LDAP://CN=SuperUser,DC=company,DC=local";
        if (!DirectoryEntry.Exists(distinguishedName))
            return;
        DirectoryEntry deEntry = new DirectoryEntry(distinguishedName);
        try
        {
            deEntry.Invoke("SetPassword", "MyNew@#123Pass12091");
        }
        catch (Exception e)
        {
            Console.WriteLine(e);
        }
        Console.Read();

EDIT - added after the comments

And so too lazy to help ungrateful users, additionally the cons are also clicked ... For you specially on the test stand put an AD domain and a client not connected to the domain for a clean check!

static void Main(string[] args)
    {
        Console.WriteLine($"Client - {Environment.UserDomainName}\\{Environment.MachineName}");
        try
        {
            DirectoryEntry dirEntrForeignDomain = new DirectoryEntry();
            dirEntrForeignDomain.AuthenticationType = AuthenticationTypes.ServerBind;
            dirEntrForeignDomain.Path = $"LDAP://172.28.145.73/DC=kul,DC=local";
            dirEntrForeignDomain.Username = $"Администратор@kul.local";
            dirEntrForeignDomain.Password = $"Qwerty123";

            SetPasswordUser(dirEntrForeignDomain); // but it is better to use OFFICIAL - AuthenticablePrincipal.SetPassword(String)
            ResetPasswordUser(dirEntrForeignDomain);
            UnResetPasswordUser(dirEntrForeignDomain);

        }
        catch (Exception ex)
        {
            Console.WriteLine(ex);
        }
        Console.Read();
    }

    static public void SetPasswordUser(DirectoryEntry de)
    {
        using (DirectorySearcher dirSearchUser = new DirectorySearcher(de))
        {
            dirSearchUser.Filter = "(&(objectClass=user)(sAMAccountName=test))";
            SearchResult searchResUser = dirSearchUser.FindOne();
            if (searchResUser != null)
            {
                DirectoryEntry dirEntryFoundUser = searchResUser.GetDirectoryEntry();
                dirEntryFoundUser.Invoke("SetPassword", new object[] { "Qwerty!!!" });
                dirEntryFoundUser.CommitChanges();
                Console.WriteLine("Set password is - Qwerty!!!");
            }
        }
    }
    static public void ResetPasswordUser(DirectoryEntry de)
    {
        using (DirectorySearcher dirSearchUser = new DirectorySearcher(de))
        {
            dirSearchUser.Filter = "(&(objectClass=user)(sAMAccountName=test))";
            SearchResult searchResUser = dirSearchUser.FindOne();
            if (searchResUser != null)
            {
                DirectoryEntry dirEntryFoundUser = searchResUser.GetDirectoryEntry();
                dirEntryFoundUser.Properties["pwdLastSet"].Value = 0;
                dirEntryFoundUser.CommitChanges();
                Console.WriteLine("ResetPasswordUser!");
            }
        }
    }
    static public void UnResetPasswordUser(DirectoryEntry de)
    {
        using (DirectorySearcher dirSearchUser = new DirectorySearcher(de))
        {
            dirSearchUser.Filter = "(&(objectClass=user)(sAMAccountName=test))";
            SearchResult searchResUser = dirSearchUser.FindOne();
            if (searchResUser != null)
            {
                DirectoryEntry dirEntryFoundUser = searchResUser.GetDirectoryEntry();
                dirEntryFoundUser.Properties["pwdLastSet"].Value = -1;
                dirEntryFoundUser.CommitChanges();
                Console.WriteLine("UnResetPasswordUser ...");
            }
        }
    }

• Set a password for a user from another domain
• For a user in a different domain set a requirement to change the password
• For a user in a different domain unSet a requirement to change the password

Logs

Client - DESKTOP-KUL\\DESKTOP-KUL
Set password is - Qwerty!!!
ResetPasswordUser!
UnResetPasswordUser ...

It is very strange that you failed with "SetPassword" via "UserPrincipal"...