netusersetinfo as a standard user?

We have a web application running in IIS/Coldfusion.

One of the requirements of the app is that users can change their domain passwords from within the web app.  This is necessary as not all users of the app will be domain users (ie do not log onto machines on the domain, they authenticate agaisnt the domain solely for acces to the app).

We are using HP ProtectTools authentication services for domain authentication, meaning that all password functions must use their PwdGenUtil.dll.

Our web developer has written the code to change passwords using the dll and thisworks perfectly when logged in as a user with domain administration privileges, however it fails with an 'access denied' erro when run as a standard user (we have put the same code into a vbscript and tested at the command prompt and get the same results there).

Having spoken to HP, their code uses 'netusersetinfo' to change the password.  Reading up on this function, it would seem that this it requires admin rights on the domain to work.

Is there anything we can do to get this working as a standard user (short of granting all users the right to change passwords, which is not really an option!).

Thanks
Richard
richardchestertonAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Dave_DietzCommented:
Is the PwdGenUtil.dll instantiated as a COM+ component in your password changing app?

Dave Dietz
0
richardchestertonAuthor Commented:
Hi Dave

Thanks for your response.

I forwarded your question t our web developer and his response was:

"yes, I believe so. I think that anytime any code has to interact with any system components, the only way to do this is through creating a COM object and passing the data around through that."

Hardly conclusive, but unfortunately that's the best I can get at this stage.  If you have any way of clarifying this, please let me know (I am no expert in coding or web creation).

Thanks
Richard
0
Dave_DietzCommented:
It may be possible to set the DLL up in a COM+ package set to activate as a Server package.

This way you can set the identity of the package to that of an administrator and *just* the DLL will run with elevated privileges.

May want to bring this idea up with your developer....  :-)

Dave Dietz
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft IIS Web Server

From novice to tech pro — start learning today.