C # Change AD Directoryservices Password

Question

I am trying to get the following code to work, there is a problem, sometimes it happens, sometimes it is not. when it fails, it gives error 0x800704F1 "the system cannot contact the domain controller to service the authentication request" I would say that about 90% of the time it fails. I tried to give it a static DC, adding it for a context that, unfortunately, did not help. For the admin user, it always works. However, I believe that users should be able to change their own password. The error is triggered on the userchange.passpassword page

I hope someone else has a bright idea.

        using (var context = new PrincipalContext(ContextType.Domain))
        {
            using (var user = UserPrincipal.Current)
            {
                try
                {
                    user.ChangePassword(txt_old.Text, txt_new.Text);
                    user.Save();

                }
                catch(Exception p)
                {
                    if (p.HResult.Equals("0x800708C5"))//Not secure enough according to password policy
                    {
                        MessageBox.Show("Volgens het systeem is uw nieuwe wachtwoord niet veilig genoeg, voldoet het aan alle eisen?", "Niet gelukt", MessageBoxButtons.OK, MessageBoxIcon.Warning);
                        return;
                    }
                    else if (p.HResult.Equals("0x80070056")) //Wrong current password
                    {
                        MessageBox.Show("U heeft een verkeerd huidig wachtwoord ingevult, probeer het nogmaals", "Verkeerd wachtwoord", MessageBoxButtons.OK, MessageBoxIcon.Warning);
                        return;
                    }
                    else if (p.InnerException.ToString().Contains("0x80070775")) //Temporarly locked out.
                    {
                        MessageBox.Show("Uw account is tijdelijk vergrendeld door te veel pogingen tot in te loggen met een foutief wachtwoord. Probeer het over 15minuten nogmaals of neem contact op met de helpdesk.", "vergrendeld.", MessageBoxButtons.OK, MessageBoxIcon.Warning);
                        return;
                    }
                    else
                    {
                        MessageBox.Show(System.Security.Principal.WindowsIdentity.GetCurrent().Name + Environment.NewLine + p.HResult + Environment.NewLine + p.Message);
                        return;
                    }
                }
            }
        }

Answer 1

Windows 3177108 3167679 ChangePassword.

: https://social.msdn.microsoft.com/Forums/vstudio/en-US/77dc733e-a13d-4349-9088-8065b85d5c3f/userprincipalchangepassword-stops-working-after-windows-updates-3177108-and-3167679?forum=netfxbcl

, UPN PrincipalContext.

IP , , .

, - , , :

System.DirectoryServices.AccountManagement.PrincipalOperationException: . , . ( HRESULT: 0x800704F1)

04-10-2016: , , / , - ChangePassword . , , , , , (, /, ).

: https://technet.microsoft.com/en-us/library/dd772723(v=ws.10).aspx , .

( , MUST CHANGE NEXT LOGON FLAG), .

Answer 2

, . , , , , 5, , 5, , .

, ( ), : TargetInvocationException: COM, Active Directory..

, , .

Answer 3

: 10/12/2016: Microsoft : https://support.microsoft.com/en-us/kb/3177108. , "", Kerberos reset.

11 2016 . Microsoft , https://technet.microsoft.com/en-us/library/security/ms16-101.aspx, , ( https://support.microsoft.com/en-us/kb/3177108, , ).

---

, . Microsoft Windows, NTLM .

№ 1 ( "" ): KB , .

https://support.microsoft.com/en-us/kb/3177108

https://support.microsoft.com/en-us/kb/3167679

, , , ? , ?

, :

using (var user = UserPrincipal.FindByIdentity(context, IdentityType.SamAccountName, "test.user0001"))

using (var user = UserPrincipal.FindByIdentity(context, IdentityType.UserPrincipalName, "[e-mail]"))

, ( ), admin. , , , .

Answer 4

sysadmin : , , , ; , (, , ).

(CyberArk Privileged Session Manager), - , ; , , .

, : , , , . , , ( , , , , , - ... meh).

, , : KB3177108 KB3167679, ( ) KB3175024 KB3174644; , - .

, , , KB3177108 KB3167679 , KB3175024 KB3174644.