3.1.5.10.2 SamrOemChangePasswordUser2 (Opnum 54)

  • Article

The SamrOemChangePasswordUser2 method changes a user's password. 

 long SamrOemChangePasswordUser2(
   [in] handle_t BindingHandle,
   [in, unique] PRPC_STRING ServerName,
   [in] PRPC_STRING UserName,
   [in, unique] PSAMPR_ENCRYPTED_USER_PASSWORD NewPasswordEncryptedWithOldLm,
   [in, unique] PENCRYPTED_LM_OWF_PASSWORD OldLmOwfPasswordEncryptedWithNewLm

);

BindingHandle: An RPC binding handle parameter as specified in [C706] section 1.

ServerName: A counted string, encoded in the OEM character set, containing the NETBIOS name of the server; this parameter MAY<65> be ignored by the server.

UserName: A counted string, encoded in the OEM character set, containing the name of the user whose password is to be changed; see message processing later in this section for details on how this value is used as a database key to locate the account that is the target of this password change operation.

NewPasswordEncryptedWithOldLm: A cleartext password encrypted according to the specification of SAMPR_ENCRYPTED_USER_PASSWORD (section 2.2.6.21), where the key is the LM hash of the existing password for the target user (as presented by the client). The cleartext password MUST be encoded in an OEM code page character set (as opposed to UTF-16).

OldLmOwfPasswordEncryptedWithNewLm: The LM hash of the target user's existing password (as presented by the client) encrypted according to the specification of ENCRYPTED_LM_OWF_PASSWORD (section 2.2.7.3), where the key is the LM hash of the cleartext password obtained from decrypting NewPasswordEncryptedWithOldLm (see the preceding description for decryption details).

Upon receiving this message, the server MUST process the data from the message subject to the following constraints:

  1. On a DC configuration if Active Directory is not running, the server MUST abort the request and return an error status.

  2. All database operations MUST occur in a single transaction.

  3. The server MUST encode the UserName parameter into UTF-16 using the OEM code page.

  4. Let U be the user account with the sAMAccountName attribute value of UserName. The server MUST return STATUS_WRONG_PASSWORD if no such account exists.

  5. Let Stored-LM-Hash be the value of the dBCSPwd attribute from the database decrypted using the algorithm specified in section 2.2.11.1, using U's RelativeId as the key. If this attribute does not exist, STATUS_WRONG_PASSWORD MUST be returned.

  6. Let Presented-Clear-Text be the cleartext value sent by the client. This value is obtained by decrypting NewPasswordEncryptedWithOldLm according to the specification of SAMPR_ENCRYPTED_USER_PASSWORD using Stored-LM-Hash as the key, and then translating the result into a UTF-16 encoded string (using the OEM code page).

  7. Let Presented-Old-LM-Hash be the value of OldLmOwfPasswordEncryptedWithNewLm that has been decrypted per the specification of ENCRYPTED_LM_OWF_PASSWORD, using the LM hash of Presented-Clear-Text as the key.

  8. If Presented-Old-LM-Hash is not equal to Stored-LM-Hash, the server MUST satisfy the constraints in section 3.1.5.14.6, abort processing, and return STATUS_WRONG_PASSWORD.

  9. The server MUST update the clearTextPassword attribute with Presented-Clear-Text.