System.Web.Security.ActiveDirectoryMembershipProvider.ResetPassword Method

Resets a user's password to a new, automatically generated password.

Syntax

public override string ResetPassword (string username, string answer)

Parameters

answer
Documentation for this section has not yet been entered.
username
The user to reset the password for.

Returns

The new password for the specified user.

Remarks

The method is called by the System.Web.Security.Membership class to reset the password for a user in the Active Directory data store to a new randomly generated value. The new password is returned.

Note:

The random password created by the ActiveDirectoryMembershipProvider.ResetPassword(string, string) method is not guaranteed to pass the regular expression in the ActiveDirectoryMembershipProvider.PasswordStrengthRegularExpression property. However, the random password will meet the criteria established by the ActiveDirectoryMembershipProvider.MinRequiredPasswordLength and ActiveDirectoryMembershipProvider.MinRequiredNonAlphanumericCharacters properties.

If an incorrect answer is supplied to the ActiveDirectoryMembershipProvider.ResetPassword(string, string) method, the internal counter that tracks invalid password-answer attempts is incremented by one. This can result in the user being unable to log on until the lock status is cleared by a call to the ActiveDirectoryMembershipProvider.UnlockUser(string) method. If the correct password answer is supplied and the user is not currently locked out, then the internal counter that tracks invalid password attempts is reset to zero. For more information, see the ActiveDirectoryMembershipProvider.MaxInvalidPasswordAttempts and ActiveDirectoryMembershipProvider.PasswordAttemptWindow properties.

Leading and trailing spaces are trimmed from all parameter values.

You can call the ActiveDirectoryMembershipProvider.ResetPassword(string, string) method directly by first obtaining a reference to the System.Web.Security.ActiveDirectoryMembershipProvider instance from the Membership.Provider property.

The provider uses a subtree search starting at the search point specified in the connection string. See the System.Web.Security.ActiveDirectoryMembershipProvider class topic for more information about connection strings.

To set passwords on an Active Directory server, the connectionProtection attribute must be set to ActiveDirectoryConnectionProtection.SignAndSeal.

When using an ADAM server, the connectionProtection attribute can be set to ActiveDirectoryConnectionProtection.None, but only if you explicitly configure the ADAM server to allow password changes over unsecured connections.

Note:

You cannot reset passwords unless the credentials used to connect to the Active Directory server have either Domain Administrator rights (not recommended) or the "reset password" access right.

To reset a password, all of the following conditions must be true:

  • The ActiveDirectoryMembershipProvider.EnablePasswordReset property must be set to true.

  • The Active Directory schema must be modified to contain attributes for storing the password question and answer, and the three tracking fields for password answer changes.

  • The attributeMapPasswordQuestion, attributeMapPasswordAnswer, attributMapFailedPasswordAnswerCount, attributeMapFailedPasswordAnswerTime, and attributeMapFailedPasswordAnswerLockedTime attributes must be set in the application configuration file.

  • The ActiveDirectoryMembershipProvider.RequiresQuestionAndAnswer property must be set to true.

  • The security context for connecting to the Active Directory data store (either the process account or the explicit credentials) must have sufficient privileges to change passwords. The credentials used to connect to the Active Directory server have either Domain Administrator rights (not recommended) or the "reset password" access right.

Note:

Security policies set on the Active Directory server may make it impossible for the ActiveDirectoryMembershipProvider.ResetPassword(string, string) method to generate a password that satisfies the policies. The default implementation of the ActiveDirectoryMembershipProvider.GeneratePassword method will generate passwords that satisfy the default password policies on domain controllers running Windows Server 2003 SP1. If the password cannot be reset due to security policies on the Active Directory server, a System.Configuration.Provider.ProviderException is thrown.

Requirements

Namespace: System.Web.Security
Assembly: System.Web (in System.Web.dll)
Assembly Versions: 2.0.0.0
Since: .NET 2.0