<div class="content" name="NetrServerPasswordSet2" uuid="14b020a8-0bcf-4af5-ab72-cc92bc6b1d81"><p>The <b>NetrServerPasswordSet2</b> method SHOULD<a id="Appendix_A_Target_188"></a><a aria-label="Product behavior note 188" href="0c858a52-732a-43ec-85dd-e44b357c1898#Appendix_A_188" data-linktype="relative-path">&lt;188&gt;</a> allow the client to set a new
clear text password for an account used by the <span><a href="b5e7d25a-40b2-41c8-9611-98f53358af66#gt_76a05049-3531-4abd-aec8-30e19954b4bd" data-linktype="relative-path">domain controller</a></span>
for setting up the <span><a href="b5e7d25a-40b2-41c8-9611-98f53358af66#gt_08ce423c-9f9c-48ed-afa8-8b64c04ecdca" data-linktype="relative-path">secure channel</a></span> from
the client. A <span><a href="b5e7d25a-40b2-41c8-9611-98f53358af66#gt_6234a38c-ed1b-4c69-969f-6e6479566f65" data-linktype="relative-path">domain member</a></span> SHOULD<a id="Appendix_A_Target_189"></a><a aria-label="Product behavior note 189" href="0c858a52-732a-43ec-85dd-e44b357c1898#Appendix_A_189" data-linktype="relative-path">&lt;189&gt;</a> use this function to
periodically change its machine account password. A <span><a href="b5e7d25a-40b2-41c8-9611-98f53358af66#gt_663cb13a-8b75-477f-b6e1-bea8f2fba64d" data-linktype="relative-path">PDC</a></span> uses this
function to periodically change the trust password for all directly <span><a href="b5e7d25a-40b2-41c8-9611-98f53358af66#gt_5ee032d0-d944-4acb-bbb5-b1cfc7df6db6" data-linktype="relative-path">trusted</a></span>
domains. </p><dl>
<dd>
<div><pre> NTSTATUS NetrServerPasswordSet2(
   [in, unique, string] LOGONSRV_HANDLE PrimaryName,
   [in, string, range(0,256)] wchar_t* AccountName,
   [in] NETLOGON_SECURE_CHANNEL_TYPE SecureChannelType,
   [in, string, range(0,256)] wchar_t* ComputerName,
   [in] PNETLOGON_AUTHENTICATOR Authenticator,
   [out] PNETLOGON_AUTHENTICATOR ReturnAuthenticator,
   [in] PNL_TRUST_PASSWORD ClearNewPassword
 );
</pre></div>
</dd></dl><p><b>PrimaryName: </b>The custom <span><a href="b5e7d25a-40b2-41c8-9611-98f53358af66#gt_44deb72d-c62b-4335-90e4-b9fd4dd782ed" data-linktype="relative-path">binding
handle</a></span>, as defined in section <span><a href="3b224201-b531-43e2-8c79-b61f6dea8640" data-linktype="relative-path">3.5.4.1</a></span>.</p><p><b>AccountName: </b>The null-terminated <span><a href="b5e7d25a-40b2-41c8-9611-98f53358af66#gt_c305d0ab-8b94-461a-bd76-13b40cb8c4d8" data-linktype="relative-path">Unicode</a></span>
string that contains the name of the account whose password is being changed.<a id="Appendix_A_Target_190"></a><a aria-label="Product behavior note 190" href="0c858a52-732a-43ec-85dd-e44b357c1898#Appendix_A_190" data-linktype="relative-path">&lt;190&gt;</a></p><p><b>SecureChannelType: </b>An enumerated value that
defines the secure channel to be used for authentication, as specified in
section <span><a href="4d1235e3-2c96-4e9f-a147-3cb338a0d09f" data-linktype="relative-path">2.2.1.3.13</a></span>.</p><p><b>ComputerName: </b>The null-terminated Unicode
string that contains the <span><a href="b5e7d25a-40b2-41c8-9611-98f53358af66#gt_0334e0bd-2755-42f6-aeff-2d4a22bf4abf" data-linktype="relative-path">NetBIOS name</a></span> of the
computer making the request.</p><p><b>Authenticator: </b>A pointer to a <b>NETLOGON_AUTHENTICATOR</b>
structure, as specified in section <span><a href="76c93227-942a-4687-ab9d-9d972ffabdab" data-linktype="relative-path">2.2.1.1.5</a></span>, that
contains the encrypted logon <span><a href="b5e7d25a-40b2-41c8-9611-98f53358af66#gt_b505ab37-868d-426c-bb19-af21e675e0b8" data-linktype="relative-path">credential</a></span> and a
time stamp.</p><p><b>ReturnAuthenticator: </b>A pointer to a <b>NETLOGON_AUTHENTICATOR</b>
structure, as specified in section 2.2.1.1.5, that contains the server return <span><a href="b5e7d25a-40b2-41c8-9611-98f53358af66#gt_e72a2c02-84a2-4ce3-b66f-86f725642dc3" data-linktype="relative-path">authenticator</a></span>.</p><p><b>ClearNewPassword: </b>A pointer to an <span><a href="52d5bd86-5caf-47aa-aae4-cadf7339ec83" data-linktype="relative-path">NL_TRUST_PASSWORD</a></span>
structure, as specified in section 2.2.1.3.7, that contains the new password
encrypted<a id="Appendix_A_Target_191"></a><a aria-label="Product behavior note 191" href="0c858a52-732a-43ec-85dd-e44b357c1898#Appendix_A_191" data-linktype="relative-path">&lt;191&gt;</a> as specified in <span><a href="b348c16e-5cdb-4414-876d-e8b0e12fbae0" data-linktype="relative-path">Calling NetrServerPasswordSet2 (section 3.4.5.2.6)</a></span>.</p><p><b>Return Values: </b>The method returns 0x00000000
on success; otherwise, it returns a nonzero error code.</p><p>On receiving this call, the server MUST perform the
following validation steps:</p><ul><li><p><span><span> 
</span></span>Apply Common Error Processing Rule A, specified in section <span><a href="2d776bfc-e81f-4c8f-9da8-4c2920f65413" data-linktype="relative-path">3</a></span>.</p>
</li><li><p><span><span> 
</span></span>Using the <i>ComputerName</i> for the secure channel to find the
corresponding record in the ClientSessionInfo table, verify the <i>Authenticator</i>
parameter (section <span><a href="da7acaa3-030b-481e-979b-f58f89389806" data-linktype="relative-path">3.1.4.5</a></span>). If the <i>Authenticator</i>
parameter is valid, compute the <i>ReturnAuthenticator</i> parameter returned
(section 3.1.4.5). Otherwise, the server MUST return STATUS_ACCESS_DENIED.</p>
</li><li><p><span><span> 
</span></span>Apply Common Error Processing Rule B, specified in section 3, to
the <i>PrimaryName</i> parameter.</p>
</li></ul><p>If the server <i>RefusePasswordChange</i> variable (section <span><a href="b8d168ac-ebb6-42f4-bfb2-7a84377f2cbc" data-linktype="relative-path">3.5.1</a></span>)
is set and the <i>SecureChannelType</i> is WorkstationSecureChannel, the server
MUST return STATUS_WRONG_PASSWORD.</p><p>The server MUST decrypt the new password supplied in the <i>ClearNewPassword</i>
parameter, by using the negotiated encryption algorithm (determined by bits C,
O, or W, respectively, in the <b>NegotiateFlags</b> member of the <b>ClientSessionInfo</b>
table entry for <i>ComputerName</i>) and the <span><a href="b5e7d25a-40b2-41c8-9611-98f53358af66#gt_4f67a585-fb00-4166-93e8-cf4abca8226d" data-linktype="relative-path">session key</a></span>
established as the <span><a href="b5e7d25a-40b2-41c8-9611-98f53358af66#gt_8bf79983-1325-42db-8e2c-520c8ab2ae74" data-linktype="relative-path">decryption</a></span> key. The
NTOWFv1 (as specified in NTLM v1 Authentication in <span><a href="../ms-nlmp/b38c36ed-2804-4868-a9ff-8dd3182128e4" data-linktype="relative-path">[MS-NLMP]</a></span>
section <span><a href="../ms-nlmp/464551a8-9fc4-428e-b3d3-bc5bfb2e73a5" data-linktype="relative-path">3.3.1</a></span>)
of the cleartext password MUST be computed.</p><p>The server MUST compute or retrieve (see unicodePwd, <span><a href="../ms-ada3/4517e835-3ee6-44d4-bb95-a94b6966bfb0" data-linktype="relative-path">[MS-ADA3]</a></span>
section <span><a href="../ms-ada3/71e64720-be27-463f-9cc5-117f4bc849e1" data-linktype="relative-path">2.332</a></span>)
the NTOWFv1 of the current client machine password, which is stored as the
result of the <span><a href="b5e7d25a-40b2-41c8-9611-98f53358af66#gt_9a5d11c7-eea9-4217-b9a8-478c6786e9e8" data-linktype="relative-path">OWF</a></span> on the clear
text password for the AccountName. If the current password matches the new
password, success is returned to the client, but no actual password change is
performed. </p><p>The server MUST change the SharedSecret abstract value to
the new password supplied in the <i>ClearNewPassword</i> parameter. If the
value of the <b>PasswordVersionPresent</b> field of the ClearNewPassword.Buffer
parameter is equal to 0x02231968, the server MUST change the <b>TrustPasswordVersion</b>
abstract value to the value of the <b>PasswordVersionNumber</b> field of the
ClearNewPassword.Buffer parameter. See section <span><a href="cba0e87e-b91f-411b-9be8-6fd321e126b7" data-linktype="relative-path">2.2.1.3.8</a></span> for more
details about the type of the <i>ClearNewPassword</i> parameter.</p><p>This method SHOULD only be called by a machine that has
established a secure channel with the server.</p><p>This method also returns errors based on Common Error
Processing Rule D, specified in section 3.</p></div>