Password Expiration In Active Directory

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

fshin - 09 Aug 2007 20:50 GMT

Hello,

Is there a way to tell when a password is expired (or if its already expired)
in active directory using cfldap or ColdFusion?
Also, is there a way for a user to modify their own AD password through CF?

Thanks,
Frank

Reply to this Message

Michael - 06 Sep 2007 01:50 GMT

1. There is an attribute "accountExpires" that contains a timestamp in the
number of milliseconds from Jan 1, 1970. Also, check out "userAccountControl".
That attribute also controls if an account is disabled or not. I don't
remember, however, if it changes when an account is expired. That would be
easy enough to test, however.

2. Yes, but it requires installing an SSL cert on the CF server and using
secured LDAP. Also, you have to convert the password value to unicode. The
attribute is "unicodePwd". I have not done this because I use an easier method.

Use CFEXECUTE to run the "net user" command. You can use that command to set
a domain account's password. The main requirement is that your CF service must
be running as a domain account. That same domain account must also be a member
of the Account Operators domain group. (Or, at least, have permissions to
change a user's password.)

Reply to this Message

Webmaster Forum / ColdFusion / Advanced Techniques / September 2007

Password Expiration In Active Directory