The following table lists the constraints that MUST be
satisfied (in the order presented) in order to return the associated output
parameters to the client. All fields of ValidatePasswordChangeOutput MUST be
set to 0 before any constraints are met.
Constraint
Condition (fields based on
ValidatePasswordChangeInput)
ValidatePasswordChangeOutput changes
1
LockoutTime plus DomainLockoutDuration is greater than
the current time.
ValidationStatus MUST be set to
SamValidateAccountLockedOut.
2
LockoutTime plus DomainLockoutDuration is less than or
equal to the current time.
LockoutTime MUST be set to 0.
3
PasswordLastSet plus DomainMinimumPasswordAge is
greater than the current time.
ValidationStatus MUST be set to
SamValidatePasswordTooRecent.
4
PasswordMatch is zero, and BadPasswordTime plus
DomainLockoutObservationWindow is greater than or equal to the current time.
ValidationStatus MUST be set to
SamValidatePasswordIncorrect.
BadPasswordCount MUST be set to
ValidatePasswordChangeInput.BadPasswordCount plus 1.
BadPasswordTime MUST be set to
the current time.
5
PasswordMatch is zero, and BadPasswordTime plus
DomainLockoutObservationWindow is less than the current time.
ValidationStatus MUST be set to
SamValidatePasswordIncorrect.
BadPasswordCount MUST be set to
1.
BadPasswordTime MUST be set to
the current time.
If DomainLockoutThreshold is
greater than 0 and BadPasswordCount is greater than or equal to
DomainLockoutThreshold, LockoutTime MUST be set to the current time.
6
PasswordMatch is nonzero, and HashedPassword is equal
to at least one of the first DomainPasswordHistoryLength elements of
PasswordHistory (without exceeding the number of elements in PasswordHistory)
where the Length field of HashedPassword is equal to the Length field of the
PasswordHistory element.
ValidateStatus MUST be set to
SamValidatePasswordIsInHistory.
7
PasswordMatch is nonzero.
The constraints in section 3.1.1.8.5 MUST be
satisfied, where sAMAccountName is
ValidatePasswordChangeInput.UserAccountName and userAccountControl is
UF_NORMAL_ACCOUNT; on error, ValidationStatus MUST be set as follows:
If the minimum password length constraint fails,
ValidationStatus MUST be SamValidatePasswordTooShort.
If the maximum password length constraint fails,
ValidationStatus MUST be SamValidatePasswordTooLong.
If any other constraint in section 3.1.1.7.2 or section
3.1.1.8.5 fails, ValidationStatus MUST be
SamValidatePasswordNotComplexEnough.<73>
If any constraint from item 1
failed, the server MUST return STATUS_SUCCESS.
Otherwise (if no constraint from
item 1 failed), PasswordHistory MUST be updated such that
ValidatePasswordChangeInput.HashedPassword is the first element in
PasswordHistory, and ValidatePasswordChangeInput.InputPersistedFields.PasswordHistory
elements are used, starting from the left, to fill the remaining elements of
PasswordHistory such that PasswordHistory contains as many elements as
possible up to DomainPasswordHistoryLength elements.
PasswordHistoryLength MUST be
updated to be DomainPasswordHistoryLength.
PasswordLastSet MUST be set to
the current time.
BadPasswordCount is set to 0.
ValidationStatus MUST be set to
SamValidateSuccess.
The server MUST return any
processing errors; otherwise, it MUST return STATUS_SUCCESS.