Active Directory's UAC PASSWD_CANT_CHANGE Doesn't Work

[kbisignani]

First off, thank you for this amazing resource. I've only scratched the surface of it and it's going to help save so much time in the development I'm doing.

I am working on a project to automate the creation of student accounts (an internal tool for my department). Something we prevent is the ability for students to change their passwords. There's a User Account Control flag - PASSWD_CANT_CHANGE - that's supposed to enable this, however as per Microsoft (see here: https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties#property-flag-descriptions), this is not how it works, and instead you need to set security descriptors on the user object.

I have a sinking feeling this isn't going to work...

[stevebauman]

Hi @kbisignani, thanks for your kind words! I'm glad you've found LdapRecord useful.

The link you've posted is for ActiveDirectory UserAccountControl settings. LdapRecord allows you to manipulate these:

https://ldaprecord.com/docs/core/v3/active-directory/users/#user-account-control

https://ldaprecord.com/docs/core/v3/active-directory/users/#available-constants

<?php

use LdapRecord\Models\ActiveDirectory\User;
use LdapRecord\Models\Attributes\AccountControl;

$user = User::find('cn=John Doe,ou=Users,dc=local,dc=com');

// Setting the UAC value manually:
$user->userAccountControl = 512; // Normal, enabled account.

// Or, using the UAC builder:
$user->userAccountControl = (new AccountControl)->setAccountIsNormal();

$user->save();

Let me know if this isn't what you're referring to so I can help you further 👍

[stevebauman]

Or is this what you're referring to?

https://www.ldapexplorer.com/en/manual/107070210-editor-ms-securitydescriptor.htm

[kbisignani]

My apologies for the confusion in my original post @stevebauman . The link I posted brought you too far down on the page. If you scroll up a little, the following note is placed on the "PASSWD_CANT_CHANGE" flag:

You can't assign this permission by directly modifying the UserAccountControl attribute. For information about how to set the permission programmatically, see the Property flag descriptions section.

Essentially, adding "64" to the $user->userAccountControl by manual assignment, or, programmatically, $uac->setPasswordCannotBeChanged();, won't work.

According to the continuing documentation here, it looks like I need to work with the ntSecurityDescriptor and parse the IADsSecurityDescriptor... but I'm not sure that's a thing that's possible with LdapRecord. I'd be thrilled to be wrong! But this is such a niche case I'm not sure where to proceed.

[stevebauman]

No worries @kbisignani, and thanks for the clarification!

According to these resources here, you'll likely need to add a server control to the query used to retrieve the user, so Active Directory includes the attribute in the result:

https://stackoverflow.com/a/40774136/2708607
https://stackoverflow.com/a/40773088/2708607

You can add server controls to queries via the addControl method:

https://ldaprecord.com/docs/core/v3/searching-api/#addcontrol

Can you try the below to see if the attribute is included in the returned user's attributes? If so, we can continue from there on how to manipulate it:

$user = User::query()->addControl(LDAP_SERVER_SD_FLAGS_OID, true, 7)->find(
    'cn=John Doe,ou=Users,dc=local,dc=com'
);

dd($user->getAttributes());

[kbisignani]

Okay, just deleted my last reply. I combined what you sent with code from the two links you included in your post to come up with this:

$user = User::query()->addControl('1.2.840.113556.1.4.801', true, sprintf("%c%c%c%c%c", 48, 3, 2, 1, 7))->find(
    'cn=John Doe,ou=Users,dc=local,dc=com'
);

That got me some extra information, including...

  ["ntsecuritydescriptor"]=>
  array(1) {
    [0]=>
    string(1880) " [lots of unreadable characters here...]"
  }

So... how the heck does one parse this?? lol
But the fact that this can be pulled in the first place at least means it's accessible, and perhaps "settable" for when I make a new account.

[stevebauman]

Awesome, glad you were able to figure it out and get the property returned.

Right now, LdapRecord doesn't provide the utilities to modify this attribute, but it looks like there's an abandoned LDAP library that provides this capability. I think we can port it over, maintain it (it's MIT), and add credits to the author in the implementation:

http://www.phpldaptools.com/tutorials/AD-Permissions/

[kbisignani]

I'm glad you posted LDAPTools because I stumbled on the same thing after I posted my reply, and saw the same thing you did, it appears to be abandoned, which made me shy away from touching it. I'm going to play with it later today and see if it can make heads or tails with the ntSecurityDescriptor data I pulled. I'll keep you posted on my findings.

[kbisignani]

Well that wasn't easy, but combining forces, I was able to use LdapTools to parse and modify the ntSecurityDescriptor that I read with LdapRecord in order to enable the "User cannot change password" account options:

$sd = new SecurityDescriptor($user->getAttribute('ntsecuritydescriptor')[0]);

// Flip the Everyone ACE type to deny for the 'WD' SID ('WD' is the SID short name for "Everyone").
foreach ($sd->getDacl()->getAces() as $ace) {
   if ((string) $ace->getTrustee() === SID::SHORT_NAME['WD'] && (string) $ace->getObjectType() === AceRights::EXTENDED['CHANGE_PASSWORD']) {
	   $ace->setType('OD');
   }
}

// OD is short for an object deny ace type...
$ace = (new Ace('OD'))
    // The SID of the user being granted the right ('PS' is the SID short name for "Principal Self").
    ->setTrustee('PS')
    // This is an extended access right for "User cannot change password"...
    ->setObjectType(AceRights::EXTENDED['CHANGE_PASSWORD'])
    // This sets the ACE with the "Control Access" right...
    ->setRights(new AceRights(AceRights::SHORT_NAME['CR']));
$sd->getDacl()->addAce($ace);

// Now set the new Security Descriptor value and save it
$user->setAttribute('ntSecurityDescriptor', $sd->toBinary());
$user->save();

@stevebauman - I want to thank you for your help on this, and for pointing me in the right direction. While I like to think I have a decent handle on LDAP, setting ntSecurityDesciptor really threw me!

[stevebauman]

Awesome! 🎉 Really glad you were able to get it working 👏

Oh no worries at all, you did all the work here. Thanks for posting your working solution!

I'll create an issue from this discussion to port LdapTool's utilities for this into LdapRecord. I'll work on it over the weekend 👍