Directory Services–Cannot Change Password – Constraint Violation nTSecurityDescriptor
Recently I ran into an issue where trying to enable or disable the option ‘Cannot Change Password’ in Active Directory in my C# code. Using a Domain Administrator account the code worked perfectly fine, but when it was run under a non-administrator I would get “Constrain Violation Occurred” and the following exception
"0000051B: AtrErr: DSID-030F22B2, #1:\n\t0: 0000051B: DSID-030F22B2, problem 1005 (CONSTRAINT_ATT_TYPE), data 0, Att 20119 (nTSecurityDescriptor)\n"
Now the user in question was delegated full control over the user object which made it more frustrating as it could be done manually within Active Directory Users and Computers. What I did find out is that if the non-administrator user was assigned the owner of the user in the security option the code would work and is what lead me to the answer.
You must have the DirectoryEntry.Options.SecurityMasks defined to SecurityMasks.Dacl for it to work for a non-administrator user.
Allow Change Password
1: public static void AllowChangePassword(DirectoryEntry user)
2: {
3: user.Options.SecurityMasks = SecurityMasks.Dacl;
4:
5: // Create a Guid that identifies the Change Password right.
6: Guid changePasswordGuid =
7: new Guid("{AB721A53-1E2F-11D0-9819-00AA0040529B}");
8:
9: // Get the ActiveDirectorySecurity for the user.
10: ActiveDirectorySecurity userSecurity = user.ObjectSecurity;
11:
12: // Create a SecurityIdentifier object for "everyone".
13: SecurityIdentifier everyoneSid =
14: new SecurityIdentifier(WellKnownSidType.WorldSid, null);
15:
16: // Create a SecurityIdentifier object for "self".
17: SecurityIdentifier selfSid =
18: new SecurityIdentifier(WellKnownSidType.SelfSid, null);
19:
20: // Create an access rule to allow everyone the change password
21: // right.
22: // This is used to remove any existing access rules.
23: ActiveDirectoryAccessRule allowEveryone =
24: new ActiveDirectoryAccessRule(
25: everyoneSid,
26: ActiveDirectoryRights.ExtendedRight,
27: AccessControlType.Allow,
28: changePasswordGuid);
29:
30: // Create an access rule to deny everyone the change password right.
31: ActiveDirectoryAccessRule denyEveryone =
32: new ActiveDirectoryAccessRule(
33: everyoneSid,
34: ActiveDirectoryRights.ExtendedRight,
35: AccessControlType.Deny,
36: changePasswordGuid);
37:
38: // Create an access rule to allow self the change password right.
39: // This is used to remove any existing access rules.
40: ActiveDirectoryAccessRule allowSelf =
41: new ActiveDirectoryAccessRule(
42: selfSid,
43: ActiveDirectoryRights.ExtendedRight,
44: AccessControlType.Allow,
45: changePasswordGuid);
46:
47: // Create an access rule to deny self the change password right.
48: ActiveDirectoryAccessRule denySelf =
49: new ActiveDirectoryAccessRule(
50: selfSid,
51: ActiveDirectoryRights.ExtendedRight,
52: AccessControlType.Deny,
53: changePasswordGuid);
54:
55: // Remove any existing rule that gives "everyone" the change
56: // password right.
57: userSecurity.RemoveAccessRuleSpecific(denyEveryone);
58:
59: // Add a new access rule to deny "everyone" the change password
60: // right.
61: userSecurity.AddAccessRule(allowEveryone);
62:
63: // Remove any existing rule that gives "self" the change password
64: // right.
65: userSecurity.RemoveAccessRuleSpecific(denySelf);
66:
67: // Add a new access rule to deny "self" the change password right.
68: userSecurity.AddAccessRule(allowSelf);
69:
70: // Commit the changes.
71: user.CommitChanges();
72:
73: user.Options.SecurityMasks = SecurityMasks.None;
74: }
Deny Change Password
1: public static void DenyChangePassword(DirectoryEntry user)
2: {
3: user.Options.SecurityMasks = SecurityMasks.Dacl;
4:
5: // Create a Guid that identifies the Change Password right.
6: Guid changePasswordGuid =
7: new Guid("{AB721A53-1E2F-11D0-9819-00AA0040529B}");
8:
9: // Get the ActiveDirectorySecurity for the user.
10: ActiveDirectorySecurity userSecurity = user.ObjectSecurity;
11:
12: // Create a SecurityIdentifier object for "everyone".
13: SecurityIdentifier everyoneSid =
14: new SecurityIdentifier(WellKnownSidType.WorldSid, null);
15:
16: // Create a SecurityIdentifier object for "self".
17: SecurityIdentifier selfSid =
18: new SecurityIdentifier(WellKnownSidType.SelfSid, null);
19:
20: // Create an access rule to allow everyone the change password
21: // right.
22: // This is used to remove any existing access rules.
23: ActiveDirectoryAccessRule allowEveryone =
24: new ActiveDirectoryAccessRule(
25: everyoneSid,
26: ActiveDirectoryRights.ExtendedRight,
27: AccessControlType.Allow,
28: changePasswordGuid);
29:
30: // Create an access rule to deny everyone the change password right.
31: ActiveDirectoryAccessRule denyEveryone =
32: new ActiveDirectoryAccessRule(
33: everyoneSid,
34: ActiveDirectoryRights.ExtendedRight,
35: AccessControlType.Deny,
36: changePasswordGuid);
37:
38: // Create an access rule to allow self the change password right.
39: // This is used to remove any existing access rules.
40: ActiveDirectoryAccessRule allowSelf =
41: new ActiveDirectoryAccessRule(
42: selfSid,
43: ActiveDirectoryRights.ExtendedRight,
44: AccessControlType.Allow,
45: changePasswordGuid);
46:
47: // Create an access rule to deny self the change password right.
48: ActiveDirectoryAccessRule denySelf =
49: new ActiveDirectoryAccessRule(
50: selfSid,
51: ActiveDirectoryRights.ExtendedRight,
52: AccessControlType.Deny,
53: changePasswordGuid);
54:
55: // Remove any existing rule that gives "everyone" the change
56: // password right.
57: userSecurity.RemoveAccessRuleSpecific(allowEveryone);
58:
59: // Add a new access rule to deny "everyone" the change password
60: // right.
61: userSecurity.AddAccessRule(denyEveryone);
62:
63: // Remove any existing rule that gives "self" the change password
64: // right.
65: userSecurity.RemoveAccessRuleSpecific(allowSelf);
66:
67: // Add a new access rule to deny "self" the change password right.
68: userSecurity.AddAccessRule(denySelf);
69:
70: // Commit the changes.
71: user.CommitChanges();
72:
73: user.Options.SecurityMasks = SecurityMasks.None;
74: }
Directory Services–Cannot Change Password – Constraint Violation nTSecurityDescriptor Read More »