Re: Changing a user password via LDAP in Active Directory

[Booker C. B. <bb...@ne...>]

On Mon, 15 Jan 2001, Edgington, Jeffrey Alan wrote:

> I can change everything else about a user via Net::LDAP except the password.
> I haven't had much luck finding anything on the MS web site about this.
>
> If someone has successfully done this via Net::LDAP, I would greatly
> appreciate some guidance.
>

- AD is both an ldap server and a kerberos KDC. I <think> you can only
change the password by using Microsoft's version of the kerberos
changepasswd protocol. There is software and an draft rfc describing
how to do this. I know you can change the password with this code.

- ACL's are another kettle of fish entirely. We've been bugging MS
about how to do this for monthes and have yet to get a straight
answer. The best guess I've heard is that you can change them via
LDAP, you just need to reverse engineer the undocumented contents
of the attribute.

- Booker C. Bense