共用方式為


3.1.5.13.7.3 SamValidatePasswordReset

The following table lists the constraints that MUST be satisfied (in the order presented) in order to return the associated output parameters to the client. All fields of ValidatePasswordResetOutput MUST be set to 0 before any constraints are met.

Constraint

Condition (fields based on ValidatePasswordResetInput)

ValidatePasswordResetOutput changes

1

Always

  1. The constraints in section 3.1.1.8.5 MUST be satisfied, where sAMAccountName is ValidatePasswordChangeInput.UserAccountName and userAccountControl is UF_NORMAL_ACCOUNT; on error, ValidationStatus MUST be set as follows:

    1. If the minimum password length constraint fails, ValidationStatus MUST be SamValidatePasswordTooShort.

    2. If the maximum password length constraint fails, ValidationStatus MUST be SamValidatePasswordTooLong.

    3. If any other constraint in section 3.1.1.7.2 or section 3.1.1.8.5 fails, ValidationStatus MUST be SamValidatePasswordNotComplexEnough.<74>

  2. If any constraint from item 1 failed, the server MUST return STATUS_SUCCESS.

2

PasswordMustChangeAtNextLogon is nonzero.

PasswordLastSet MUST be set to zero.

3

PasswordMustChangeAtNextLogon is zero.

PasswordLastSet MUST be set to the current time.

4

ClearLockout is nonzero.

  1. LockoutTime MUST be set to 0.

  2. If ValidatePasswordResetInput.InputPersistedFields.BadPasswordCount is nonzero, BadPasswordCount MUST be set to 0.

5

Always

  1. PasswordHistory MUST be updated such that ValidatePasswordResetInput.HashedPassword is the first element in PasswordHistory and ValidatePasswordResetInput.InputPersistedFields.PasswordHistory elements are used, starting from the left, to fill the remaining elements of PasswordHistory such that PasswordHistory contains as many elements as possible up to DomainPasswordHistoryLength elements.

  2. PasswordHistoryLength MUST be updated to be DomainPasswordHistoryLength.

  3. BadPasswordCount MUST be set to 0.

  4. ValidationStatus MUST be set to SamValidateSuccess.

  5. The server MUST return any processing errors; otherwise, it MUST return STATUS_SUCCESS.