Chris May

I should have known it wasn't over.

I am still making steady progress, but I am still finding stupid problems along the way.

Someone told me that they thought my assessment of my security problem was correct, that I need to get the ASP.NET worker thread to have higher access, not the default IIS user account, by using impersonation. I havn't found a way to do impersonation on just 1 page, so I think I will need to move the login page to a different directory and add another .config file.

Some of the goofy things I am finding are:

1. When searching the directory for a user object, if you want to later call the .Invoke("SetPassword",agrs[]) then you need to specify the schema as "user" when doing the cnAD.Children.Find("CN=MyUser","user") method.
2. If you try to invoke the ADSI "SetPassword" and you try to use the same password that the account already has, it will throw an error.
   I'm guessing this is because there is probably something indicating that the user must change the password or something, to get around this, I am first changing the password to a GUID, and then changing it again to what I want it to be.
   Call cnNewUser.Invoke("SetPassword", New Object() {New Guid().ToString()})