Config snippets : ADLDS : Reset password without SSL

by | Jan 23, 2012 | Directory Services, Infrastructure, Scripting, SysAdmin, Windows | 6 comments

By default ADLDS does not allow to reset password on users created in ADLDS repository over connection without SSL. As sometimes there is a need to build test environment with ADLDS quick, SSL is the last thing which anyone would care about, especially if main thing to test is script automating password resets.

So, for convenience of the developers ADLDS allows to disable requirements for SSL connection to reset passwords. How to disable that reuqirement? See below how it was done on server where ADLDS was installed on port 50389:

C:\Windows\ADAM>dsmgmt
dsmgmt: DS Behavior
AD DS/LDS behavior: Connections
server connections: Connect to server localhost:50389
Binding to localhost:50389 ...
Connected to localhost:50389 using credentials of locally logged on user.
server connections: q
AD DS/LDS behavior: Allow Passwd op on unsecured connection
Successfully modified AD DS/LDS Behavior to reset password over unsecured network.
AD DS/LDS behavior: q
dsmgmt: q
C:\Windows\ADAM>

6 Comments

  1. Maelito
    Maelito on February 15, 2013 at 2:49 pm

    him great article, thanks.

    I have an error: Search on AD DS/LDS behavior object failed with error: 32 (no Ushc Object)

    I can connect fine to the server the error occurs after I issue the allow command.

    any ideas what could be?

    Maelito

  3. Stephan
    Stephan on July 31, 2013 at 9:13 am

    Great article, saved my ass 😉

    Note: it might be necessary to specify the LDAP admin user first. By default it uses the currently logged in Windows user.

    server connections: set creds
    server connections: connect to server localhost:

  4. Stephan
    Stephan on July 31, 2013 at 9:14 am

    Great article, saved my ass 😉

    Note: it might be necessary to specify the LDAP admin user first. By default it uses the currently logged in Windows user.

    server connections: set creds DOMAIN USERNAME PASSWORD
    server connections: connect to server localhost:PORT

  5. Stephan
    Stephan on July 31, 2013 at 10:44 am

    To make this change persistent across restarts, you can modify the following attribute: dSHeuristics

    The attribute is bound to the following object: CN=Directory Service, CN=Windows NT, CN=Services, CN=Configuration, CN=DOMAIN

    For example, set the value to 0000000011001 to enable both password change over LDAP, and to set the password in clear text in the attribute userPassword. You can use ADSI Edit to connect to the Configuration context and change the attribute.

    See the following sites.

    http://msdn.microsoft.com/en-us/library/cc223560.aspx
    http://technet.microsoft.com/en-us/library/cc546864.aspx

  6. SKufel
    SKufel on July 31, 2013 at 3:56 pm

    That is true. I made asusmption that whoever is making sucha a change is logged in with admn rights.

Submit a Comment