Capture password change at active directory controller

Question

I've seen a couple of software packages run as a service on an active directory controller which captures a password change initiated by a user. My application needs to know what the newly changed password is for a user to propagate across other systems. Does anyone know how this is done? Thanks.

BTW, I'm writing in C#, but other .net languages are welcome.

Answer 1

You will need to create a Password Filter on the Active Directory Server, specifically the PasswordChangeNotify callback. Unfortunately to use one you must make a COM Server DLL which really shouldn't be written in .NET^†.

However, there is a 2nd option. There is a open source password filter I have used in the past that worked well called Password Hook. That password filter will launch a 2nd program (as defined in the registry) and pass in the password info as command line arguments (like your .NET program to update the other services of the password change).

---

^{†: I saw a good posting here on SO on why you should not use .NET in windows components when I was looking in to password stuff a year ago, but I can't find it again. If anyone else can find it, please feel free to edit in the link}