If you have a small portal at work and need to provide a way for people to reset their password(s) or have certain authorized people reset password(s), here is a easy solution. In addition to the password reset, I also unlock the account since they have probably locked the account from trying to log in with the wrong password a million times!
Before you start, you need to know a few things first. Use Microsoft’s Active Directory Users and Computers (“ADUC”) Administrator tool on a Domain Controller to find these facts.
- Domain Name (ADUC)
e.g. microsoft.local and MICROSOFT - Domain Controller Name (ADUC, look under Domain Controllers)
- User Container (e.g. Item where all your users are located, default is “Users”)
In the example below, the company local domain is “MICROSOFT.COM” and the pre-Windows 2000 name is “MICROSOFT”. My domain controller is called “SERVER1” and all my users are in the default “USERS” container.
// Import the following namespace
using System.DirectoryServices;
/// <summary>
/// Reset a user's domain password, using a domain administrators account.
/// </summary>
/// <param name="acct">User who needs a password reset.</param>
/// <param name="username">Administrator User Name</param>
/// <param name="password">Administrator Password</param>
/// <param name="newpassword">User's new password</param>
public void resetPassword(string acct, string username, string password, string newpassword)
{
try
{
// LDAP Connection String
string path = "LDAP://SERVER1/OU=USERS,DC=MICROSOFT,DC=LOCAL";
// Prefix to Add to User Name (e.g. MICROSOFT\Administrator)
string Domain = "MICROSOFT\\"; //Pre-Windows 2000 Name
// Establish LDAP Connection
DirectoryEntry de = new DirectoryEntry(path, Domain + username, password, AuthenticationTypes.Secure);
// LDAP Search Filter
DirectorySearcher ds = new DirectorySearcher(de);
ds.Filter = "(&(objectClass=user)(|(sAMAccountName=" + acct + ")))";
// LDAP Properties to Load
ds.PropertiesToLoad.Add("displayName");
ds.PropertiesToLoad.Add("sAMAccountName");
ds.PropertiesToLoad.Add("DistinguishedName");
ds.PropertiesToLoad.Add("CN");
// Execute Search
SearchResult result = ds.FindOne();
string dn = result.Properties["DistinguishedName"][0].ToString();
DirectoryEntry uEntry = new DirectoryEntry("LDAP://" + dn, username, password);
uEntry.Invoke("SetPassword", new object[] { newpassword }); //Set New Password
uEntry.Properties["LockOutTime"].Value = 0; //Unlock Account
uEntry.CommitChanges();
uEntry.Close();
}
catch (Exception e)
{
// Log Error
}
}
The function above does all the work, but this probably won’t work by default since IIS is normally run under a low privileged local account. In order to change somebody’s password you need to use Impersonate a Domain Administrator’s account to have this capability.
** Important note, if your admin accounts are stored with your user accounts then this code could be used to reset your admin password! This is a big NO-NO since it could effectively lock you out of the network. Consider putting your users in a different container/OU and setting the filter to only look in this one place!
