How to set/change Active Directory user password across domains using C# .NET?

Question

I have been searching around for quite some time now how to set/change a password and revoke/restore a user but have yet to find a solution that actually works for me.

I am beginning to lean towards the fact that I am crossing domains as the problem, even though I can programmatically create/delete/update and even connect/disconnect users from groups.

Basically, I've tried the following ways:

DirectoryEntry account = new DirectoryEntry("LDAP://" + adHostname + "/" + dn, adUserName, adPassword);

account.Invoke("SetPassword", "Password1");
account.Properties["LockOutTime"].Value = 0;
account.CommitChanges();

And also

account.Invoke("SetPassword", new object[] { "Password1" });

They both ultimately throw the error "One or more input parameters are invalid\r\n"

I then have tried to use the .NET 3.5 approach using principal context.

using (var context = new PrincipalContext(ContextType.Domain, adHostname, myContainer, ContextOptions.SimpleBind, adUserName, adPassword))
    {
        using (var user = UserPrincipal.FindByIdentity(context, account.Properties["sAMAccountName"].Value.ToString()))
        {
             user.SetPassword(password);
        }
    }    

This approach is also throwing the same error as above. If I switch some things around (I can't seem to remember all the combinations I've tried), it will sometimes throw a "Local error has occurred" COM Exception.

Any help is much appreciated.

---

## EDIT WITH WORKING SOLUTION ##

using System.DirectoryServices.Protocols;

LdapDirectoryIdentifier identifier = new LdapDirectoryIdentifier(_adHostname, 636);
NetworkCredential credential = new NetworkCredential(_adUserName, _adPassword);

string password = "MyRandomComplexPassword";


using (LdapConnection connection = new LdapConnection(identifier, credential))
{
    connection.SessionOptions.SecureSocketLayer = true;
    connection.SessionOptions.VerifyServerCertificate += delegate { return true; };
    connection.AuthType = AuthType.Basic;
    connection.Bind(credential);

    DirectoryAttributeModification modPwd = new DirectoryAttributeModification();
    modPwd.Operation = DirectoryAttributeOperation.Replace;
    modPwd.Name = "unicodePwd";
    modPwd.Add(Encoding.Unicode.GetBytes("\"" + password + "\""));

    DirectoryAttributeModification[] dMods = new DirectoryAttributeModification[1];
    dMods[0] = modPwd;

    ModifyRequest modReq = new ModifyRequest(accountDN, dMods);

    DirectoryResponse pwdModResponse;
    pwdModResponse = connection.SendRequest(modReq);    
}

Answer 1

"new DirectoryEntry" does not bind the user account. The user needs to be searched out for setting password. Like this:

DirectoryEntry account = new DirectoryEntry("LDAP://" + adHostname + "/" + dn, null, null, AuthenticationTypes.Secure | AuthenticationTypes.Sealing | AuthenticationTypes.Signing);

DirectorySearcher search = new DirectorySearcher(account);
search.Filter = "(&(objectClass=user)(sAMAccountName=" + adUserName + "))";
account = search.FindOne().GetDirectoryEntry();

account.Invoke("SetPassword", "Password1");
account.Properties["LockOutTime"].Value = 0;
account.CommitChanges();