Active Directory访问拒绝DirectoryEntry上的异常。调用ChangePassword

Question

Following MVC web api code works without errors

directoryEntry.Invoke("SetPassword", "desired password");
directoryEntry.CommitChanges();

But same application/service account get an error when attempting

directoryEntry.Invoke("ChangePassword", "old password", "new password");
directoryEntry.CommitChanges();

Error details: System.UnauthorizedAccessException: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED)) System.UnauthorizedAccessException: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))

Does invoking ChangePassword require different permissions that SetPassword?

Answer 1

You might be getting the access denied error due to the "User cannot change password" setting flag being checked. Any users for which you want to allow their password to be changed will need that setting unchecked.

Answer 2

check your application pool identity user in IIS7 set the user which has the admin rights to change the AD password

you can find it under iis 7 >> application pools then select the application pool which your application using then right click on it and select advance setting then locate Process Model under this you will find Identity attribute here set the correct user which has admin rights