How to detemine if the ADS account password needs to be reset at first login

Question

An ADS entry is created with .ExpirePasswordNow() (requiring user to change the password on firstLogin).. But authentication fails if the .ExpiresPasswordNow() is set.. How could I get authenticator (Domain principal) to accept this as a valid account ?

Answer 1

Instead of using ExpirePasswordNow, set the property [pwdLastSet] to 0.

usr.Properties["pwdLastSet"].Value = -1; // To turn on, set this value to 0.
usr.CommitChanges();

http://msdn.microsoft.com/en-us/library/ms180915.aspx