The supported password-change protocols are:

  1. The NetUserChangePassword protocol
  2. The NetUserSetInfo protocol
  3. The Kerberos change-password protocol (IETF Internet Draft Draft-ietf-cat-kerb-chg-password-02.txt) [port 464]
  4. Kerberos set-password protocol (IETF Internet Draft Draft-ietf-cat-kerberos-set-passwd-00.txt) [port 464]
  5. Lightweight Directory Access Protocol (LDAP) write-password attribute (if 128-bit Secure Sockets Layer [SSL] is used)
  6. XACT-SMB for pre-Microsoft Windows NT (LAN Manager) compatibility

Change-password operations require that the user’s current password be known before the change is allowed. Set-password operations do not have this requirement, but are controlled by the Reset Password permissions on the account.

When you are using LDAP (method 5), the domain controller and the client must both be able to use 128-bit SSL to protect the connection. If the domain controller is not configured for SSL or if appropriately long keys are not available, the password-change write is denied.

An Active Directory domain controller listens for change-password requests on all of these protocols.

As stated earlier in this article, different protocols are used in different circumstances. For example:

  • Interoperable Kerberos clients use the Kerberos protocols. UNIX-based systems with MIT Kerberos version 5 1.1.1 can change user passwords in a Windows-based domain by using the Kerberos change-password protocol (method 3).
  • When a user changes his or her own password by pressing CTRL+ALT+DELETE and then clicking Change Password, Windows NT up to Windows 2003 the NetUserChangePassword mechanism (method 1) is used if the target is a domain. From Windows Vista onwards, the Kerberos change password protocol is used for domain accounts. If the target is a Kerberos realm, the Kerberos change-password protocol (method 3) is used.
  • Requests to change a password from computers that are running Microsoft Windows 95/Microsoft Windows 98 use XACT-SMB (method 6).
  • A program that uses the ChangePassword method on the Active Directory Services Interface (ADSI) IaDSUser interface first tries to change the password by using LDAP (method 5), and then by using the NetUserChangePassword protocol (method 1).
  • A program that uses the SetPassword method on the ADSI IaDSUser interface first tries to change the password by using LDAP (method 5), then the Kerberos set-password protocol (method 4), and then the NetUserSetInfo protocol (method 2).
  • The Active Directory Users and Computers snap-in uses ADSI operations for setting user passwords.

58 Replies to “KB264480”

  1. Every weekend i used to pay a visit this web site, because
    i want enjoyment, since this this site conations in fact pleasant funny material too.

    Look at my blog; sawa

  2. First of all I want to say awesome blog! I had a quick question which I’d like to ask if you do not mind.
    I was curious to know how you center yourself and clear your thoughts prior to writing.
    I have had a tough time clearing my mind in getting my thoughts out there.
    I do take pleasure in writing but it just seems like the first 10 to 15 minutes tend
    to be wasted simply just trying to figure out how to begin. Any
    recommendations or tips? Kudos!

    my web blog :: roots pelham

  3. naturally like your web-site however you need to tst the spelling on quite a few of your posts.
    A number of them are rife with spelling problems and I find it very troublesome to inform the truth nevertheless I’ll surely come again again.

    Alsoo visit my page … treat baldness

Leave a Reply