Remote password change/account unlock

From: Ivan Karpov (nbdnwhr@mail.no.spam.ru)
Date: 03/31/03 

From: "Ivan Karpov" <nbdnwhr@mail.no.spam.ru>
Date: Mon, 31 Mar 2003 11:07:52 -0500

I need to design a system that would allow users to change/reset their
passwords in NT domain and unlock the accounts if they're locked as a result
of failed login attempts. Here's what I want to do:

User -> ASP and COM component -> DC with NT Service running

COM component here would simply make DCOM call to NT service running on DC
which will run under Administrator's account so it can make calls like:

Set objUser = GetObject("WinNT://MYDC/jsmith,user")
objUser.SetPassword "foo"

What are security implications of this solution? Is there a better way?

IVAN KARPOV

Relevant Pages

  • Re: Remote password change/account unlock
    ... Allowing users to change or reset their passwords or unlock their accounts ... There are security implications to having a service running as ...
    (microsoft.public.win2000.security)
  • Re: How 2 confirm delegation?
    ... How are you trying to unlock and/or reset accounts? ... > delegated control of a group to this new security group ...
    (microsoft.public.exchange2000.active.directory.integration)
  • Re: Account lockouts
    ... Not sure why you didn't find the lockouts in your logs. ... look at the free windows tools and look for unlock. ... quickly give you a list of all locked out accounts in a domain, ... > the outlook address book and attempts to log on to active directory. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Righs to unlock accounts:Set "read/write accountlockout" time, but option is still gra
    ... > I need to allow helpdesk to 'unlock' accounts under a certain OU. ... > then click Delegate Control from the menu that is displayed. ... The Delegation of Control Wizard should be displayed. ...
    (microsoft.public.win2000.active_directory)
  • Re: unlock user accounts en masse
    ... I have a sample program to find out if a given user is locked out, ... and then allow the user to unlock the account linked here: ... here is a sample program to document all accounts ... You might want to use a program that lists all locked out users, ...
    (microsoft.public.windows.server.scripting)