RE: [ActiveDir] Password Filter DLL and Trust Password

[joe]

Well if you wrote the password filter, write in output calls with OutputDebugString and use DebugView to check them out while doing your password changes.

 

OutputDebugString: http://msdn.microsoft.com/library/default.asp?url="">

DebugView: http://www.sysinternals.com/ntw2k/freeware/debugview.shtml

 

 

---

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Santhosh Sivarajan
Sent: Friday, January 07, 2005 11:19 AM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] Password Filter DLL and Trust Password

I am also using Windows 2003 with latest updates.  I don't have any utility to check the output of the PasswordFilter faction.  How do I do it?

joe <[EMAIL PROTECTED]> wrote:

Nope, you don't need to use PasswordChangeNotify, my filter hooks both functions and dumps them to debug output so I can see what is being passed through the functions.

 

Which version of Windows 2003 are you using? My test was run on 2003 with all current QFEs (No SP). How did you verify besides unloading the DLL? Do you have the ability to output what your PasswordFilter function is seeing?

 

I will go back and doublecheck the C++ code but last I recall, my filter was a simple pass through, all params sent to PasswordFilter were dumped to debug.

 

 

   joe

 

 

---

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Santhosh Sivarajan
Sent: Friday, January 07, 2005 8:19 AM
To: ActiveDir@mail.activedir.org
Subject: Re: [ActiveDir] Password Filter DLL and Trust Password

Thanks for reply. I will check the Password Filter code again today.  But I am not using PasswordChangeNotify function.  I am only using PasswordFilter.  Do I have to have PasswordChangeNotifiy.  But I verified that Trust password is using the password filter dll.  Is it a new feature in windows 2003? : -)

----- Original Message -----

From: joe

To: ActiveDir@mail.activedir.org

Sent: Friday, January 07, 2005 12:33 AM

Subject: RE: [ActiveDir] Password Filter DLL and Trust Password

Did you write the custom filter? If so, have it dump what it is doing to debug and watch it. I would be a little shocked if trust passwords were being sent through the PasswordFilter function.

 

Heh, me guessing wasn't good enough, I just tested it on K3 OEM with one of my own custom filters. Trusts do not hit the PasswordFilter function nor the PasswordChangeNotify function. Interestingly enough, computer password changes hit PasswordChangeNotify which isn't the way it used to be (I don't recall it that way anyway), however they don't hit PasswordFilter which makes sense.

 

So... You need to verify you aren't seeing something different with your filter. Once you do that you can move on to what else it might be.

 

  joe

---

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Santhosh Sivarajan
Sent: Thursday, January 06, 2005 11:14 PM
To: ActiveDir@mail.activedir.org
Subject: [ActiveDir] Password Filter DLL and Trust Password   

I am facing an issue after installing a custom password filter DLL. Password filter DLL is working fine for user password change.  But when I try to create a trust between NT and Windows 2003, it is not accepting any password combinations.  I disable the custom password filter DLL, and then it is started accepting the trust passwords.  We dont have any code in the password filter DLL to check the trust password.  Is it a normal behavior?  I know trust is also calling LSA to check the password complexity.  Do I need to include trust password checking code in the password filter DLL?  Is there anything else I am missing in the Password Filter DLL? How about computer passwords?

 

Any input would be greatly appreciated!