IADs::SetInfo fails with "Access Denied" under Credential Provider
Hi,
We are having a credential provider for Biometric devices and SmartCard logon. We are storing the credentials of domain users in Active Directory whose schema we extend with 2 proprietery attributes to the User object. When a password change is done through our credential provider we update the data in AD. Here is the problem (Win7 x32 client, Win2003 x32 server): Although the user objects in the AD schema have the right SYSTEM with Full Control the IADs::SetInfo fails with 0x80050007 "Access Denied". It is interesting that the "Get" functions work in the same sequence of calls. The same piece of code Works under our GINA on XP. I know that Winlogon.exe has all the privileges whereas LogonUI.exe is more restrictive (does not have SE_RESTORE_NAME etc.) but the privileges should not have anything to do with the rights. Right? When I give the TestUser object in ADSIEdit.msc/Domain/Users/TestUser the Everyone Full Control then it works. But LogonUI.exe runs under SYSTEM account and the TestUser having SYSTEM Full Control should/must be enough.Right? So what could be the reason for this error? I. |
All times are GMT. The time now is 08:54 AM. |
Powered by vBulletin® Version 3.6.4
Copyright ©2000 - 2024, Jelsoft Enterprises Ltd.
Search Engine Optimization by vBSEO 3.0.0 RC6
Copyright ©2004-2006 VistaBanter.com