Temporarily changing passwords in AD by storing hash somewhere else

[crai...@gmail.com]

As a sysadmin, I'd like to be able to temporarily change a users
password, such that I can log onto their machine, make profile-specific
local changes, and then set it back to the original password.

I want to do this by copying the password hash from userPassword or
unicodePwd to somewhere like extensionAttribute1, changing the password
as usual, and then copying it back when finished. (I would ultimately
like it to be a menu option in the MMC, such as
http://www.petri.co.il/add_unlock_user_option_to_dsa.htm)

I read on the web and the newsgroups that you can't read the password
hash via LDAP. There are utilities that will attempt to crack a
password DB - where are they getting their hashes from? Is there a
simple way around this?

Regards
Craig

[Joe Kaplan (MVP - ADSI)]

There is no simple way around this. The cracking tools need access to the
physical DIT file and get the data that way.

Unfortunately, there is also no supported way to read or write the hashes,
so if you want to put the password back as it was, you'd need to get the
cleartext password by cracking it.

It might be better to just reset the user's password and force them to
change at next logon after you do the stuff you are doing. I realize this
goes against what you were trying to accomplish, but you are really fighting
the way AD wants to work. :)

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
--
<crai...@gmail.com> wrote in message
news:1156113103.7...@i3g2000cwc.googlegroups.com...

[Joe Richards [MVP]]

You either need to attack the DIT directly as JoeK mentions or you have
to inject code into LSASS, neither is a good thing.

--
Joe Richards Microsoft MVP Windows Server Directory Services
Author of O'Reilly Active Directory Third Edition
www.joeware.net

---O'Reilly Active Directory Third Edition now available---

http://www.joeware.net/win/ad3e.htm

[Adam]

Is there another way to solve your problem? What changes are you trying
to make? Can they be made by changing settings for the user from an
admin account?

(I don't really like the idea of resetting passwords as that would lose
anything in the protected store and I suppose that it is a Good Thing
that no-one has come up with a way for an admin to easily change a
password and then set it back.)