Overview [1] #

There are two methods on changing an AD password using LDAP.

The default setting uses the UnicodePwd and the other makes it work like most other LDAP Server Implementations by using UserPassword.

By default using UserPassword method (either through a simple ldif file or something like java) is disabled in Active Directory.

Process #

In order to enable the UserPassword method you must change the dsHeuristics [2] attribute using ADSI edit and set the fuserPassword [3] method to true.

Open ADSIedit #

(start/run adsiedit.msc)

Right Click ADSI Edit #

Right Click ADSI Edit and choose Connect to (note that this is not necessary if adsi was used previously and the connection is already there)

Select Configuration #

Choose Select a well known Naming Context of Configuration and Select Default (Domain or server that you are logged into). And click ok

Expand Configuration #

Expand Configuration down to Configuration/CN=Configuration,DC=XXX,DC=xxx/CN=Services/CN=Windows NT/CN=Directory Service

Choose Properties #

Right Click Directory Service and choose Properties

Scroll to dsHeuristics #

Scroll to dsHeuristics and double click it: You need to modify the 9th position and enter a 1. If there was no value in dsHeuristics then enter 000000001 and click ok.
It is critical that you do NOT replace other values if they already exist as there are 19 possible values within this attribute.[1]

Click Ok #

Click Ok to get back to the main editor.

Update Schema Now #

Then on the top level Configuration server.domain.org item right click and choose update Schema Now.

Finally #

At this point you can connect using SSL and use an LDIF to change the users password

More Information #

There might be more information for this subject on one of the following:

Add new attachment

Only authorized users are allowed to upload new attachments.

List of attachments

Kind Attachment Name Size Version Date Modified Author Change note
ADSI-Open.png 59.3 kB 1 29-May-2013 14:02 jim ADSI-Open
adsi-configuration.png 67.9 kB 1 29-May-2013 14:17 jim adsi-configuration
adsi-connect.png 19.1 kB 1 29-May-2013 14:00 jim ADSI-connect
adsi-dSHeuristics.png 24.3 kB 1 29-May-2013 14:17 jim adsi-dSHeuristics
adsi-expand-configuration.png 53.5 kB 1 29-May-2013 14:17 jim adsi-expand-configuration
adsi-properties.png 10.6 kB 1 29-May-2013 14:17 jim adsi-properties
adsi-update-schema.png 11.6 kB 1 29-May-2013 14:18 jim adsi-update-schema
« This page (revision-31) was last changed on 10-Aug-2016 14:04 by jim