Why does calling SetPassword on a DirectoryEntry takes 60 seconds to succeed?

dlanod_10247 0
Viewed 78

I am using the following C# code to set a user's password via the DirectoryEntry class:

user.Invoke("SetPassword", password);

The code is contained in a DLL. Loading the DLL and using this code in a service running under a GMSA takes 60 seconds to return, although successfully. However loading the DLL and using this code from a command line executable works fine - even if I use psexec to run the command line under the GMSA.

There's a fair few similar problems reported that I've tried to eliminate by the above testing, e.g. accessing port 464, or the SetPassword function falling through different mechanisms.

Why does calling SetPassword on a DirectoryEntry takes 60 seconds to succeed? Alternatively, what debugging can I do to determine why this is happening?

active-directory c#
1 Answers

In the Remarks section of the SetPassword documentation, it lists several mechanisms that it tries to set the password, because you need a secure connection to do it. I'm guessing that the first one didn't work, so it has to try 2 or maybe even all three.

The LDAP string used to create user could determine how many hoops SetPassword has to run through to find an acceptably secure method. Running from a different computer can also make a difference on which mechanisms would work, depending on firewall restrictions or if one of those computers is not joined to the same domain and the other is.

SetPassword isn't the only way to set a password. You can do it by setting the unicodePwd attribute directly, in the very specific way that the documentation describes. That looks like this in C#:

user.Properties["unicodePwd"].Value = Encoding.Unicode.GetBytes("\"NewPassword\"");
user.CommitChanges();

But you have to make sure that you're connecting in a secure way. That's not taken care for you like it is with SetPassword. You can either use LDAPS (LDAP over SSL), which requires that the server is using a trusted certificate (notice port 636):

var user = new DirectoryEntry("LDAP://example.com:636/CN=SomePerson,OU=Users,DC=example,DC=com");

Or, if the computer you are running this from is joined to the same domain or a trusted domain, then you can use Kerberos, which is done by passing AuthenticationTypes.Sealing in the constructor:

var user = new DirectoryEntry("LDAP://CN=SomePerson,OU=Users,DC=example,DC=com"
           , null, null, AuthenticationTypes.Secure | AuthenticationTypes.Sealing);

This is a way of explicitly telling it how to connect securely, rather than letting SetPassword try different methods until it finds one. So that might save time.

user_12028070
Related