[prev in list] [next in list] [prev in thread] [next in thread] 

List:       cifs-protocol
Subject:    Re: [cifs-protocol] [REG:210063056197932001] Need some
From:       Bill Wesse <billwe () microsoft ! com>
Date:       2010-07-16 13:50:28
Message-ID: 38B58112393ABF47AA9F6B99206881E1451AF312 () TK5EX14MBXC141 ! redmond ! corp ! microsoft ! com
[Download RAW message or body]

[Attachment #2 (text/plain)]

Good morning Nadya – Bill Wesse here; Obaid is out of the office, and I will be \
your contact for this case.

Could you send me a network capture of the CONSTRAINT_VIOLATION error you are \
receiving? Thanks in advance; this will help us in making sure we get things right!

Regards,
Bill Wesse
MCSE, MCTS / Senior Escalation Engineer, US-CSS DSC Protocol Team
8055 Microsoft Way
Charlotte, NC 28273
Email:   billwe@microsoft.com<mailto:billwe@microsoft.com>
Tel:       +1(980) 776-8200
Cell:      +1(704) 661-5438
Fax:      +1(704) 665-9606

From: Bill Wesse
Sent: Friday, July 16, 2010 9:48 AM
To: "nivanova@samba.org" <nivanova@samba.org>
Cc: "cifs-protocol@samba.org" <cifs-protocol@samba.org>; "MSSolve Case Email" \
                <casemail@microsoft.com>
Subject: [REG:210063056197932001] Need some clarification on the User-Change-Password \
access rights

Hi Nadya:
Thank you for clarification. I'll get back to you as soon as I have an answer.

Regards,
Obaid Farooqi
Sr. Support Escalation Engineer | Microsoft

From: didrash@gmail.com [mailto:didrash@gmail.com] On Behalf Of Nadezhda Ivanova
Sent: Tuesday, July 06, 2010 10:58 AM
To: Obaid Farooqi
Cc: cifs-protocol@samba.org; MSSolve Case Email
Subject: Re: [REG:210063056197932001] Need some clarification on the \
User-Change-Password access rights

Hi Obaid,
I am looking at:
5.1.3.3.4 Checking Control Access Right-Based Access and 2.5.4.1 Access Check \
Algorithm Pseudocode In the access check algorithms, every time an access check is \
failed, insufficient access is returned, I did not see an instance of constraint \
violation. In 5.1.3.3.4, it is mentioned that in this and this case we deny the \
requested access, which leads me to believe insufficient access is returned. If \
constraint violation is the correct response for particular case, I think we \
definitely need some disambiguation on a per Control Access Right basis...

Regards,
Nadya
On Tue, Jul 6, 2010 at 6:44 PM, Obaid Farooqi \
<obaidf@microsoft.com<mailto:obaidf@microsoft.com>> wrote: Hi Nadya:
Please let me know according to which document you should receive \
INSUFFICIENT_ACCESS_RIGHTS.

Regards,
Obaid Farooqi
Sr. Support Escalation Engineer | Microsoft

From: Obaid Farooqi
Sent: Thursday, July 01, 2010 10:22 AM
To: 'nivanova@samba.org<mailto:nivanova@samba.org>'
Cc: cifs-protocol@samba.org<mailto:cifs-protocol@samba.org>; MSSolve Case Email
Subject: RE:[REG:210063056197932001] Need some clarification on the \
User-Change-Password access rights

Hi  Nadya:
My name is Obaid Farooqi and I'll be helping you with this issue. I'll be in touch as \
soon as I have anything concrete. Please feel free to contact me if you have a \
question/clarification.

Regards,
Obaid Farooqi
Sr. Support Escalation Engineer | Microsoft

From: didrash@gmail.com<mailto:didrash@gmail.com> \
                [mailto:didrash@gmail.com<mailto:didrash@gmail.com>] On Behalf Of \
                Nadezhda Ivanova
Sent: Wednesday, June 30, 2010 6:31 AM
To: Interoperability Documentation Help; \
                cifs-protocol@samba.org<mailto:cifs-protocol@samba.org>
Subject: Need some clarification on the User-Change-Password access rights

Hello,
I am currently working on enforcing the User-Change-Password control access right on \
password change operations in Samba 4, and there are a few things that puzzle me, \
perhaps you could help. I am testing agains a Win2008 server, domain and forest \
functional levels are 2008.

The user object class has the following ACE in the defaultSecurityDescriptor:
(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;WD), \
OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;PS) I created a user and removed these \
two for the purposes of negative testing. However, when I performed a password change \
operation(delete and add of unicodePwd), I got CONSTRAINT_VIOLATION error rather than \
INSUFFICIENT_ACCESS_RIGHTS. I granted the user write property access, but the result \
was the same. Alternatively, a user to whom I explicitly denied WP access was able to \
change their password if they have User-Change-Password. So my question is:
Is the write access to unicodePwd controlled only by User-Change-Password, and WP is \
disregarded in this case? Why is the error returned CONSTRAINT_VIOLATION?

Also, given that by default we this control access right is granted to EVERYONE, this \
means that the actual line of defence is the changer knowing the original password. \
If they know the password, it does not matter which account changes the user's \
password, which makes sense. However, in this case, why bother with checking \
User-Change-Password at all? It appears that its purpose is to allow a user (or any \
account for that matter) to change the password even if they do not have WP access on \
themselves, am I correct?

Best Regards,
Nadya

________________________________


Microsoft is committed to protecting your privacy. Please read the Microsoft Privacy \
Statement<http://go.microsoft.com/fwlink/?LinkId=81184> for more information.

The above is an email for a support case from Microsoft Corp.
REPLY ALL TO THIS MESSAGE or INCLUDE \
casemail@microsoft.com<mailto:casemail@microsoft.com> IN YOUR REPLY if you want your \
response added to the case automatically. For technical assistance, please include \
the Support Engineer on the TO: line. Thank you.(*634135945473241748*)


[Attachment #3 (text/html)]

<html xmlns:v="urn:schemas-microsoft-com:vml" \
xmlns:o="urn:schemas-microsoft-com:office:office" \
xmlns:w="urn:schemas-microsoft-com:office:word" \
xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" \
xmlns="http://www.w3.org/TR/REC-html40"> <head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
	{font-family:"Cambria Math";
	panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
	{font-family:Tahoma;
	panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0in;
	margin-bottom:.0001pt;
	font-size:12.0pt;
	font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:blue;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{mso-style-priority:99;
	color:purple;
	text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
	{mso-style-priority:99;
	mso-style-link:"Balloon Text Char";
	margin:0in;
	margin-bottom:.0001pt;
	font-size:8.0pt;
	font-family:"Tahoma","sans-serif";}
span.BalloonTextChar
	{mso-style-name:"Balloon Text Char";
	mso-style-priority:99;
	mso-style-link:"Balloon Text";
	font-family:"Tahoma","sans-serif";}
span.EmailStyle19
	{mso-style-type:personal;
	font-family:"Calibri","sans-serif";
	color:#1F497D;}
span.EmailStyle20
	{mso-style-type:personal-reply;
	font-family:"Calibri","sans-serif";
	color:#1F497D;}
.MsoChpDefault
	{mso-style-type:export-only;
	font-size:10.0pt;}
@page WordSection1
	{size:8.5in 11.0in;
	margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
	{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span \
style="font-size:11.0pt;font-family:&quot;Calibri&quot;,&quot;sans-serif&quot;;color:#1F497D">Good \
morning Nadya – Bill Wesse here; Obaid is out of the office, and I will be your \
contact for this case.<o:p></o:p></span></p> <p class="MsoNormal"><span \
style="font-size:11.0pt;font-family:&quot;Calibri&quot;,&quot;sans-serif&quot;;color:#1F497D"><o:p>&nbsp;</o:p></span></p>
 <p class="MsoNormal"><span \
style="font-size:11.0pt;font-family:&quot;Calibri&quot;,&quot;sans-serif&quot;;color:#1F497D">Could \
you send me a network capture of the CONSTRAINT_VIOLATION error you are receiving? \
Thanks in advance; this will help us in making sure we get things \
right!<o:p></o:p></span></p> <p class="MsoNormal"><span \
style="font-size:11.0pt;font-family:&quot;Calibri&quot;,&quot;sans-serif&quot;;color:#1F497D"><o:p>&nbsp;</o:p></span></p>
 <div>
<p class="MsoNormal"><b><span \
style="font-size:10.0pt;font-family:&quot;Arial&quot;,&quot;sans-serif&quot;;color:black">Regards,</span></b><span \
style="font-size:11.0pt;font-family:&quot;Calibri&quot;,&quot;sans-serif&quot;;color:navy"><br>
 </span><b><span style="font-size:10.0pt;font-family:&quot;Arial&quot;,&quot;sans-serif&quot;;color:black">Bill \
Wesse</span></b><span \
style="font-size:11.0pt;font-family:&quot;Calibri&quot;,&quot;sans-serif&quot;;color:navy"><br>
 </span><span style="font-size:10.0pt;font-family:&quot;Arial&quot;,&quot;sans-serif&quot;;color:black">MCSE, \
MCTS / Senior Escalation Engineer, US-CSS&nbsp;DSC Protocol Team</span><span \
style="font-size:11.0pt;font-family:&quot;Calibri&quot;,&quot;sans-serif&quot;;color:navy"><br>
 </span><span style="font-size:10.0pt;font-family:&quot;Arial&quot;,&quot;sans-serif&quot;;color:black">8055 \
Microsoft Way</span><span \
style="font-size:11.0pt;font-family:&quot;Calibri&quot;,&quot;sans-serif&quot;;color:navy"><br>
 </span><span style="font-size:10.0pt;font-family:&quot;Arial&quot;,&quot;sans-serif&quot;;color:black">Charlotte, \
NC 28273</span><span \
style="font-size:11.0pt;font-family:&quot;Calibri&quot;,&quot;sans-serif&quot;;color:navy"><br>
 </span><span style="font-size:10.0pt;font-family:&quot;Arial&quot;,&quot;sans-serif&quot;;color:#1F497D">Email:&nbsp;&nbsp;
 </span><a href="mailto:billwe@microsoft.com"><span \
style="font-size:10.0pt;font-family:&quot;Arial&quot;,&quot;sans-serif&quot;">billwe@microsoft.com</span></a><span \
style="font-size:10.0pt;font-family:&quot;Arial&quot;,&quot;sans-serif&quot;;color:black"><o:p></o:p></span></p>
 <p class="MsoNormal"><span \
style="font-size:10.0pt;font-family:&quot;Arial&quot;,&quot;sans-serif&quot;;color:black">Tel:</span><span \
style="font-size:10.0pt;font-family:&quot;Arial&quot;,&quot;sans-serif&quot;;color:#1F497D"> \
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span><span \
style="font-size:10.0pt;font-family:&quot;Arial&quot;,&quot;sans-serif&quot;;color:black">&#43;1(980) \
776-8200<o:p></o:p></span></p> <p class="MsoNormal"><span \
style="font-size:10.0pt;font-family:&quot;Arial&quot;,&quot;sans-serif&quot;;color:black">Cell:</span><span \
style="font-size:10.0pt;font-family:&quot;Arial&quot;,&quot;sans-serif&quot;;color:#1F497D"> \
&nbsp;&nbsp;&nbsp;&nbsp; </span><span \
style="font-size:10.0pt;font-family:&quot;Arial&quot;,&quot;sans-serif&quot;;color:black">&#43;1(704) \
661-5438</span><span \
style="font-size:11.0pt;font-family:&quot;Arial&quot;,&quot;sans-serif&quot;;color:navy"><br>
 </span><span style="font-size:10.0pt;font-family:&quot;Arial&quot;,&quot;sans-serif&quot;;color:black">Fax:</span><span \
style="font-size:10.0pt;font-family:&quot;Arial&quot;,&quot;sans-serif&quot;;color:#1F497D"> \
&nbsp;&nbsp;&nbsp;&nbsp; </span><span \
style="font-size:10.0pt;font-family:&quot;Arial&quot;,&quot;sans-serif&quot;;color:black">&#43;1(704) \
665-9606<o:p></o:p></span></p> </div>
<p class="MsoNormal"><span \
style="font-size:11.0pt;font-family:&quot;Calibri&quot;,&quot;sans-serif&quot;;color:#1F497D"><o:p>&nbsp;</o:p></span></p>
 <div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span \
style="font-size:10.0pt;font-family:&quot;Tahoma&quot;,&quot;sans-serif&quot;">From:</span></b><span \
style="font-size:10.0pt;font-family:&quot;Tahoma&quot;,&quot;sans-serif&quot;"> Bill \
Wesse <br>
<b>Sent:</b> Friday, July 16, 2010 9:48 AM<br>
<b>To:</b> &quot;nivanova@samba.org&quot; &lt;nivanova@samba.org&gt;<br>
<b>Cc:</b> &quot;cifs-protocol@samba.org&quot; &lt;cifs-protocol@samba.org&gt;; \
&quot;MSSolve Case Email&quot; &lt;casemail@microsoft.com&gt;<br> <b>Subject:</b> \
[REG:210063056197932001] Need some clarification on the User-Change-Password access \
rights<o:p></o:p></span></p> </div>
</div>
<p class="MsoNormal"><o:p>&nbsp;</o:p></p>
<p class="MsoNormal"><span \
style="font-size:11.0pt;font-family:&quot;Calibri&quot;,&quot;sans-serif&quot;;color:#1F497D">Hi \
Nadya:<o:p></o:p></span></p> <p class="MsoNormal"><span \
style="font-size:11.0pt;font-family:&quot;Calibri&quot;,&quot;sans-serif&quot;;color:#1F497D">Thank \
you for clarification. I'll get back to you as soon as I have an \
answer.<o:p></o:p></span></p> <p class="MsoNormal"><span \
style="font-size:11.0pt;font-family:&quot;Calibri&quot;,&quot;sans-serif&quot;;color:#1F497D"><o:p>&nbsp;</o:p></span></p>
 <p class="MsoNormal"><span \
style="font-size:11.0pt;font-family:&quot;Calibri&quot;,&quot;sans-serif&quot;;color:#1F497D">Regards,<o:p></o:p></span></p>
 <p class="MsoNormal"><span \
style="font-size:11.0pt;font-family:&quot;Calibri&quot;,&quot;sans-serif&quot;;color:#1F497D">Obaid \
Farooqi<o:p></o:p></span></p> <p class="MsoNormal"><span \
style="font-size:11.0pt;font-family:&quot;Calibri&quot;,&quot;sans-serif&quot;;color:#1F497D">Sr. \
Support Escalation Engineer | Microsoft<o:p></o:p></span></p> <p \
class="MsoNormal"><span \
style="font-size:11.0pt;font-family:&quot;Calibri&quot;,&quot;sans-serif&quot;;color:#1F497D"><o:p>&nbsp;</o:p></span></p>
 <p class="MsoNormal"><b><span \
style="font-size:10.0pt;font-family:&quot;Tahoma&quot;,&quot;sans-serif&quot;">From:</span></b><span \
style="font-size:10.0pt;font-family:&quot;Tahoma&quot;,&quot;sans-serif&quot;"> \
didrash@gmail.com [mailto:didrash@gmail.com] <b>On Behalf Of </b>Nadezhda Ivanova<br>
<b>Sent:</b> Tuesday, July 06, 2010 10:58 AM<br>
<b>To:</b> Obaid Farooqi<br>
<b>Cc:</b> cifs-protocol@samba.org; MSSolve Case Email<br>
<b>Subject:</b> Re: [REG:210063056197932001] Need some clarification on the \
User-Change-Password access rights<o:p></o:p></span></p> <p \
class="MsoNormal"><o:p>&nbsp;</o:p></p> <p class="MsoNormal" \
style="margin-bottom:12.0pt">Hi Obaid,<br> I am looking at:<br>
5.1.3.3.4 Checking Control Access Right-Based Access and 2.5.4.1 Access Check \
Algorithm Pseudocode<br> In the access check algorithms, every time an access check \
is failed, insufficient access is returned, I did not see an instance of constraint \
violation. In 5.1.3.3.4, it is mentioned that in this and this case we deny the \
requested access, which leads me to  believe insufficient access is returned. If \
constraint violation is the correct response for particular case, I think we \
definitely need some disambiguation on a per Control Access Right basis...<br> <br>
Regards,<br>
Nadya<o:p></o:p></p>
<div>
<p class="MsoNormal">On Tue, Jul 6, 2010 at 6:44 PM, Obaid Farooqi &lt;<a \
href="mailto:obaidf@microsoft.com">obaidf@microsoft.com</a>&gt; wrote:<o:p></o:p></p> \
<div> <div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span \
style="font-size:11.0pt;color:#1F497D">Hi Nadya:</span><o:p></o:p></p> <p \
class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span \
style="font-size:11.0pt;color:#1F497D">Please let me know according to which document \
you should receive INSUFFICIENT_ACCESS_RIGHTS.</span><o:p></o:p></p> <div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span \
style="font-size:11.0pt;color:#1F497D">&nbsp;</span><o:p></o:p></p> <p \
class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span \
style="font-size:11.0pt;color:#1F497D">Regards,</span><o:p></o:p></p> <p \
class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span \
style="font-size:11.0pt;color:#1F497D">Obaid Farooqi</span><o:p></o:p></p> <p \
class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span \
style="font-size:11.0pt;color:#1F497D">Sr. Support Escalation Engineer | \
Microsoft</span><o:p></o:p></p> <p class="MsoNormal" \
style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span \
style="font-size:11.0pt;color:#1F497D">&nbsp;</span><o:p></o:p></p> </div>
<div>
<div style="border:none;border-top:solid windowtext 1.0pt;padding:3.0pt 0in 0in \
0in;border-color:-moz-use-text-color -moz-use-text-color"> <p class="MsoNormal" \
style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span \
style="font-size:10.0pt">From:</span></b><span style="font-size:10.0pt"> Obaid \
Farooqi <br>
<b>Sent:</b> Thursday, July 01, 2010 10:22 AM<br>
<b>To:</b> '</span><a href="mailto:nivanova@samba.org" target="_blank"><span \
style="font-size:10.0pt">nivanova@samba.org</span></a><span \
style="font-size:10.0pt">'<br> <b>Cc:</b> </span><a \
href="mailto:cifs-protocol@samba.org" target="_blank"><span \
style="font-size:10.0pt">cifs-protocol@samba.org</span></a><span \
style="font-size:10.0pt">; MSSolve Case Email<br> <b>Subject:</b> \
RE:[REG:210063056197932001] Need some clarification on the User-Change-Password \
access rights</span><o:p></o:p></p> </div>
</div>
<div>
<div>
<p class="MsoNormal" \
style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">&nbsp;<o:p></o:p></p> <p \
class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span \
style="font-size:11.0pt;color:#1F497D">Hi&nbsp; Nadya:</span><o:p></o:p></p> <p \
class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span \
style="font-size:11.0pt;color:#1F497D">My name is Obaid Farooqi and I'll be helping \
you with this issue. I'll be in touch as soon as I have anything concrete. Please \
feel  free to contact me if you have a question/clarification.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span \
style="font-size:11.0pt;color:#1F497D">&nbsp;</span><o:p></o:p></p> <p \
class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span \
style="font-size:11.0pt;color:#1F497D">Regards,</span><o:p></o:p></p> <p \
class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span \
style="font-size:11.0pt;color:#1F497D">Obaid Farooqi</span><o:p></o:p></p> <p \
class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span \
style="font-size:11.0pt;color:#1F497D">Sr. Support Escalation Engineer | \
Microsoft</span><o:p></o:p></p> <p class="MsoNormal" \
style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span \
style="font-size:11.0pt;color:#1F497D">&nbsp;</span><o:p></o:p></p> <p \
class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span \
style="font-size:10.0pt">From:</span></b><span style="font-size:10.0pt"> </span><a \
href="mailto:didrash@gmail.com" target="_blank"><span \
style="font-size:10.0pt">didrash@gmail.com</span></a><span style="font-size:10.0pt"> \
[mailto:</span><a href="mailto:didrash@gmail.com" target="_blank"><span \
style="font-size:10.0pt">didrash@gmail.com</span></a><span style="font-size:10.0pt">] \
<b>On Behalf Of </b>Nadezhda Ivanova<br> <b>Sent:</b> Wednesday, June 30, 2010 6:31 \
AM<br> <b>To:</b> Interoperability Documentation Help; </span><a \
href="mailto:cifs-protocol@samba.org" target="_blank"><span \
style="font-size:10.0pt">cifs-protocol@samba.org</span></a><span \
style="font-size:10.0pt"><br> <b>Subject:</b> Need some clarification on the \
User-Change-Password access rights</span><o:p></o:p></p> <p class="MsoNormal" \
style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">&nbsp;<o:p></o:p></p> <p \
class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:12.0pt">Hello,<br> I \
am currently working on enforcing the User-Change-Password control access right on \
password change operations in Samba 4, and there are a few things that puzzle me, \
perhaps you could help. I am testing agains a Win2008 server, domain and forest \
functional  levels are 2008.<br>
<br>
The user object class has the following ACE in the defaultSecurityDescriptor:<br>
(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;WD), \
OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;PS)<br> I created a user and removed \
these two for the purposes of negative testing. However, when I performed a password \
change operation(delete and add of unicodePwd), I got CONSTRAINT_VIOLATION error \
rather than INSUFFICIENT_ACCESS_RIGHTS. I granted the user write  property access, \
but the result was the same.<br> Alternatively, a user to whom I explicitly denied WP \
access was able to change their password if they have User-Change-Password.<br> So my \
question is:<br> Is the write access to unicodePwd controlled only by \
User-Change-Password, and WP is disregarded in this case?<br> Why is the error \
returned CONSTRAINT_VIOLATION?<br> <br>
Also, given that by default we this control access right is granted to EVERYONE, this \
means that the actual line of defence is the changer knowing the original password. \
If they know the password, it does not matter which account changes the user's \
password,  which makes sense. However, in this case, why bother with checking \
User-Change-Password at all? It appears that its purpose is to allow a user (or any \
account for that matter) to change the password even if they do not have WP access on \
themselves, am I correct?<br> <br>
Best Regards,<br>
Nadya<o:p></o:p></p>
<p class="MsoNormal" \
style="mso-margin-top-alt:auto;margin-bottom:12.0pt">&nbsp;<o:p></o:p></p> <div \
class="MsoNormal" align="center" style="text-align:center"> <hr size="2" width="100%" \
align="center"> </div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><br>
<br>
Microsoft is committed to protecting your privacy. Please read the <a \
href="http://go.microsoft.com/fwlink/?LinkId=81184" target="_blank"> Microsoft \
Privacy Statement</a> for more information.<br> <br>
The above is an email for a support case from Microsoft Corp.<br>
REPLY ALL TO THIS MESSAGE or INCLUDE <a href="mailto:casemail@microsoft.com" \
target="_blank"> casemail@microsoft.com</a> <br>
IN YOUR REPLY if you want your response added to the case automatically. <br>
For technical assistance, please include the Support Engineer on the TO: line. <br>
Thank you.<span style="font-size:1.0pt;color:#FEFFFF">(*634135945473241748*)</span>
<o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><o:p>&nbsp;</o:p></p>
</div>
</body>
</html>



_______________________________________________
cifs-protocol mailing list
cifs-protocol@cifs.org
https://lists.samba.org/mailman/listinfo/cifs-protocol

--===============2902172713289146420==--

[prev in list] [next in list] [prev in thread] [next in thread] 

Configure | About | News | Add a list | Sponsored by KoreLogic