c# Change AD password Directoryservices

Question

Im trying to get the following code to work, problem is, sometimes it does, sometimes it doesnt. when it fails it gives the error 0x800704F1 "the system cannot contact a domain controller to service the authentication request" I'd say about 90% of the time it fails. I have tried giving it a static DC by adding it behind the contexttype this sadly did not help. On an admin user it works always.. however i do believe users are supposed to be able to change their own password. The error is triggered on the user.changepassword line

I hope someone else has a bright idea.

        using (var context = new PrincipalContext(ContextType.Domain))
        {
            using (var user = UserPrincipal.Current)
            {
                try
                {
                    user.ChangePassword(txt_old.Text, txt_new.Text);
                    user.Save();

                }
                catch(Exception p)
                {
                    if (p.HResult.Equals("0x800708C5"))//Not secure enough according to password policy
                    {
                        MessageBox.Show("Volgens het systeem is uw nieuwe wachtwoord niet veilig genoeg, voldoet het aan alle eisen?", "Niet gelukt", MessageBoxButtons.OK, MessageBoxIcon.Warning);
                        return;
                    }
                    else if (p.HResult.Equals("0x80070056")) //Wrong current password
                    {
                        MessageBox.Show("U heeft een verkeerd huidig wachtwoord ingevult, probeer het nogmaals", "Verkeerd wachtwoord", MessageBoxButtons.OK, MessageBoxIcon.Warning);
                        return;
                    }
                    else if (p.InnerException.ToString().Contains("0x80070775")) //Temporarly locked out.
                    {
                        MessageBox.Show("Uw account is tijdelijk vergrendeld door te veel pogingen tot in te loggen met een foutief wachtwoord. Probeer het over 15minuten nogmaals of neem contact op met de helpdesk.", "vergrendeld.", MessageBoxButtons.OK, MessageBoxIcon.Warning);
                        return;
                    }
                    else
                    {
                        MessageBox.Show(System.Security.Principal.WindowsIdentity.GetCurrent().Name + Environment.NewLine + p.HResult + Environment.NewLine + p.Message);
                        return;
                    }
                }
            }
        }

Answer 1

Your problem may be that a password policy violation has occurred. That is, for example, if you have a password policy in place where users can't change their passwords to be one of their last 5, as an example, if they try to change to one of their last 5 you'll see this error thrown in my experience.

The error just before the exception you report (in my case) looks like this: TargetInvocationException: COM error attempting to change an Active Directory password..

So i'd check your password policies and make sure that your users in these cases aren't violating it.

Answer 2

The two Windows updates 3177108 and 3167679 have changed the behavior of ChangePassword.

There is a thread here about the issue: https://social.msdn.microsoft.com/Forums/vstudio/en-US/77dc733e-a13d-4349-9088-8065b85d5c3f/userprincipalchangepassword-stops-working-after-windows-updates-3177108-and-3167679?forum=netfxbcl

It seems, that you now have to specify a valid UPN when creating the PrincipalContext.

Before you could use a IP as endpoint when creating the context, now it seems it has to be a correct domain name aswell.

Furthermore, you now always receive the same exception when an error occurs - we used to receive the password policy exception for users choosing insufficient passwords, now we get:

System.DirectoryServices.AccountManagement.PrincipalOperationException: The system cannot contact a domain controller to service the authentication request. Please try again later. (Exception from HRESULT: 0x800704F1)

UPDATE 04-10-2016: The exception displayed above is really the general/generic error received for just about anything when calling ChangePassword after the updates. If for instance some of the ports involved in the protocol is blocked by a firewall, you get this one as well (applicable if you call from a server/machine that is not domain joined).

Good resource for required ports: https://technet.microsoft.com/en-us/library/dd772723(v=ws.10).aspx Note that the dynamic range is required as well.

If the user is not allowed to change password (domain policy, circumvent by setting MUST CHANGE AT NEXT LOGON FLAG) you also receive this exception.