<div class="content" name="NetrServerPasswordSet" uuid="a9331034-7f30-47bd-8aee-93bbabe90df4"><p>The <b>NetrServerPasswordSet</b> method SHOULD<a id="Appendix_A_Target_192"></a><a aria-label="Product behavior note 192" href="0c858a52-732a-43ec-85dd-e44b357c1898#Appendix_A_192" data-linktype="relative-path">&lt;192&gt;</a> set a new <span><a href="b5e7d25a-40b2-41c8-9611-98f53358af66#gt_9a5d11c7-eea9-4217-b9a8-478c6786e9e8" data-linktype="relative-path">one-way
function (OWF)</a></span> of a password for an account used by the <span><a href="b5e7d25a-40b2-41c8-9611-98f53358af66#gt_76a05049-3531-4abd-aec8-30e19954b4bd" data-linktype="relative-path">domain
controller</a></span> for setting up the <span><a href="b5e7d25a-40b2-41c8-9611-98f53358af66#gt_08ce423c-9f9c-48ed-afa8-8b64c04ecdca" data-linktype="relative-path">secure channel</a></span> from
the client. </p><dl>
<dd>
<div><pre> NTSTATUS NetrServerPasswordSet(
   [in, unique, string] LOGONSRV_HANDLE PrimaryName,
   [in, string] wchar_t* AccountName,
   [in] NETLOGON_SECURE_CHANNEL_TYPE SecureChannelType,
   [in, string] wchar_t* ComputerName,
   [in] PNETLOGON_AUTHENTICATOR Authenticator,
   [out] PNETLOGON_AUTHENTICATOR ReturnAuthenticator,
   [in] PENCRYPTED_NT_OWF_PASSWORD UasNewPassword
 );
</pre></div>
</dd></dl><p><b>PrimaryName: </b>The custom binding handle, as
defined in section <span><a href="3b224201-b531-43e2-8c79-b61f6dea8640" data-linktype="relative-path">3.5.4.1</a></span>.</p><p><b>AccountName: </b>The null-terminated Unicode
string that contains the name of the account whose password is being changed.<a id="Appendix_A_Target_193"></a><a aria-label="Product behavior note 193" href="0c858a52-732a-43ec-85dd-e44b357c1898#Appendix_A_193" data-linktype="relative-path">&lt;193&gt;</a></p><p><b>SecureChannelType: </b>An enumerated value
(specified in section <span><a href="4d1235e3-2c96-4e9f-a147-3cb338a0d09f" data-linktype="relative-path">2.2.1.3.13</a></span>) that
indicates the type of secure channel used by the client.</p><p><b>ComputerName: </b>A null-terminated Unicode string
that contains the <span><a href="b5e7d25a-40b2-41c8-9611-98f53358af66#gt_0334e0bd-2755-42f6-aeff-2d4a22bf4abf" data-linktype="relative-path">NetBIOS name</a></span> of the
client computer calling this method.</p><p><b>Authenticator: </b>A pointer to a <b>NETLOGON_AUTHENTICATOR</b>
structure, as specified in section <span><a href="76c93227-942a-4687-ab9d-9d972ffabdab" data-linktype="relative-path">2.2.1.1.5</a></span>, that
contains the client <span><a href="b5e7d25a-40b2-41c8-9611-98f53358af66#gt_e72a2c02-84a2-4ce3-b66f-86f725642dc3" data-linktype="relative-path">authenticator</a></span>.</p><p><b>ReturnAuthenticator: </b>A pointer to a <b>NETLOGON_AUTHENTICATOR</b>
structure, as specified in section 2.2.1.1.5, that contains the server return
authenticator.</p><p><b>UasNewPassword: </b>A pointer to an
ENCRYPTED_NT_OWF_PASSWORD structure, as specified in <span><a href="../ms-samr/4df07fab-1bbc-452f-8e92-7853a3c7e380" data-linktype="relative-path">[MS-SAMR]</a></span>
section <span><a href="../ms-samr/ce061fef-6d4f-4802-bd5d-26b11f14f4a6" data-linktype="relative-path">2.2.7.3</a></span>
and encrypted by the algorithm specified in section <span><a href="0be5436e-c68c-4647-8eca-fe0be3512b9b" data-linktype="relative-path">3.4.5.2.7</a></span>. </p><p><b>Return Values: </b>The method returns 0x00000000
on success; otherwise, it returns a nonzero error code.</p><p>On receiving this call, the server MUST perform the
following validation steps:</p><ul><li><p><span><span> 
</span></span>Apply Common Error Processing Rule A, specified in section <span><a href="2d776bfc-e81f-4c8f-9da8-4c2920f65413" data-linktype="relative-path">3</a></span>.</p>
</li><li><p><span><span> 
</span></span>Using the <i>ComputerName</i> for the secure channel to find the
corresponding record in the ClientSessionInfo table, verify the <i>Authenticator</i>
parameter (section <span><a href="da7acaa3-030b-481e-979b-f58f89389806" data-linktype="relative-path">3.1.4.5</a></span>). If the <i>Authenticator</i>
parameter is valid, compute the <i>ReturnAuthenticator</i> parameter returned
(section 3.1.4.5). Otherwise, the server MUST return STATUS_ACCESS_DENIED. </p>
</li></ul><p>If the <i>RefusePasswordChange</i> variable (section <span><a href="b8d168ac-ebb6-42f4-bfb2-7a84377f2cbc" data-linktype="relative-path">3.5.1</a></span>)
is set and the <i>SecureChannelType</i> is WorkstationSecureChannel, the server
MUST return STATUS_WRONG_PASSWORD.</p><p>The server MUST decrypt the new password that is supplied in
the <i>UasNewPassword</i> parameter by using the inverse to the encryption
algorithm that is specified in [MS-SAMR] section <span><a href="../ms-samr/a5252e8c-25e7-4616-a375-55ced086b19b" data-linktype="relative-path">2.2.11.1.1</a></span>,
Encrypt an NT Hash or LM Hash Value with a specified key. The <span><a href="b5e7d25a-40b2-41c8-9611-98f53358af66#gt_4f67a585-fb00-4166-93e8-cf4abca8226d" data-linktype="relative-path">session
key</a></span> is the specified key input, and the <span><a href="b5e7d25a-40b2-41c8-9611-98f53358af66#gt_8bf79983-1325-42db-8e2c-520c8ab2ae74" data-linktype="relative-path">decryption</a></span> keys are
derived using the 16-byte value process, as specified in [MS-SAMR] section <span><a href="../ms-samr/ba437786-7de8-47b4-b269-5a595c255327" data-linktype="relative-path">2.2.11.1.4</a></span>.</p><p>The server MUST compute or retrieve the NTOWFv1 (as
specified in NTLM v1 Authentication in <span><a href="../ms-nlmp/b38c36ed-2804-4868-a9ff-8dd3182128e4" data-linktype="relative-path">[MS-NLMP]</a></span>
section <span><a href="../ms-nlmp/464551a8-9fc4-428e-b3d3-bc5bfb2e73a5" data-linktype="relative-path">3.3.1</a></span>)
of the current client machine password, which is stored as an OWF of the
clear-text password for the account. </p><p>The server MUST compute or retrieve the NTOWFv1 of the old
client machine password and compare it to the NTOWFv1 of the new password supplied
in the <i>UasNewPassword</i> parameter; if they match, the server MUST return
STATUS_ACCESS_DENIED.</p><p>This method SHOULD only be called by a machine that has
established a secure channel with the server.</p><p>This method also returns errors based on Common Error
Processing Rule D, specified in section 3.</p></div>