<div class="content"><p align="right"><a href="https://msdn.microsoft.com/en-us/library/acb3204a-da8b-478e-9139-1ea589edb880" data-linktype="external">msdn link</a></p><p>The SamrUnicodeChangePasswordUser2 method changes a user
account&#39;s password.</p><dl>
<dd>
<div><pre> long SamrUnicodeChangePasswordUser2(
   [in] handle_t BindingHandle,
   [in, unique] PRPC_UNICODE_STRING ServerName,
   [in] PRPC_UNICODE_STRING UserName,
   [in, unique] PSAMPR_ENCRYPTED_USER_PASSWORD NewPasswordEncryptedWithOldNt,
   [in, unique] PENCRYPTED_NT_OWF_PASSWORD OldNtOwfPasswordEncryptedWithNewNt,
   [in] unsigned char LmPresent,
   [in, unique] PSAMPR_ENCRYPTED_USER_PASSWORD NewPasswordEncryptedWithOldLm,
   [in, unique] PENCRYPTED_LM_OWF_PASSWORD OldLmOwfPasswordEncryptedWithNewNt
 );
</pre></div>
</dd></dl><p><b>BindingHandle: </b>An RPC binding handle parameter
as specified in <a href="https://go.microsoft.com/fwlink/?LinkId=89824" data-linktype="external">[C706]</a>
section 1.</p><p><b>ServerName: </b>A null-terminated string
containing the NETBIOS name of the server; this parameter MAY<a id="Appendix_A_Target_66"></a><a aria-label="Product behavior note 66" href="fa61e5fc-f8fb-4d5b-9695-c724af0c3829#Appendix_A_66" data-linktype="relative-path">&lt;66&gt;</a> be ignored by the server.</p><p><b>UserName: </b>The name of the user. See the
message processing later in this section for details on how this value is used
as a database key to locate the <a href="7b2aeb27-92fc-41f6-8437-deb65d950921#gt_8d10bd9d-392e-431b-8218-742bdac19815" data-linktype="relative-path">account</a> that is the target
of this password change operation.</p><p><b>NewPasswordEncryptedWithOldNt: </b>A cleartext
password encrypted according to the specification of <a href="23f9ef4c-cf3e-4330-9287-ea4799b03201" data-linktype="relative-path">SAMPR_ENCRYPTED_USER_PASSWORD (section 2.2.6.21)</a>,
where the key is the <a href="7b2aeb27-92fc-41f6-8437-deb65d950921#gt_7eb5bce8-bdc5-4d61-a3d9-263ada14ba1f" data-linktype="relative-path">NT hash</a>
of the existing password for the target user (as presented by the client in the
<i>OldNtOwfPasswordEncryptedWithNewNt</i> parameter). </p><p><b>OldNtOwfPasswordEncryptedWithNewNt: </b>The NT
hash of the target user&#39;s existing password (as presented by the client)
encrypted according to the specification of <a href="ce061fef-6d4f-4802-bd5d-26b11f14f4a6" data-linktype="relative-path">ENCRYPTED_LM_OWF_PASSWORD (section 2.2.7.3)</a>,
where the key is the NT hash of the cleartext password obtained from decrypting
<i>NewPasswordEncryptedWithOldNt</i>.</p><p><b>LmPresent: </b>If this parameter is zero, <i>NewPasswordEncryptedWithOldLm</i>
and <i>OldLmOwfPasswordEncryptedWithNewNt</i> MUST be ignored; otherwise these
fields MUST be processed.</p><p><b>NewPasswordEncryptedWithOldLm: </b>A cleartext
password encrypted according to the specification of
SAMPR_ENCRYPTED_USER_PASSWORD, where the key is the <a href="7b2aeb27-92fc-41f6-8437-deb65d950921#gt_58a72159-b1e9-4770-9b06-d7a6b16279a8" data-linktype="relative-path">LM hash</a> of the existing
password for the target user (as presented by the client).</p><p><b>OldLmOwfPasswordEncryptedWithNewNt: </b>The LM
hash the target user&#39;s existing password (as presented by the client) encrypted
according to the specification of ENCRYPTED_LM_OWF_PASSWORD, where the key is
the NT hash of the cleartext password obtained from decrypting <i>NewPasswordEncryptedWithOldNt</i>.</p><p>Upon receiving this message, the server MUST process the
data from the message subject to the following constraints:</p><ol><li><p><span>    </span>On a <a href="7b2aeb27-92fc-41f6-8437-deb65d950921#gt_76a05049-3531-4abd-aec8-30e19954b4bd" data-linktype="relative-path">DC</a> configuration if <a href="7b2aeb27-92fc-41f6-8437-deb65d950921#gt_e467d927-17bf-49c9-98d1-96ddf61ddd90" data-linktype="relative-path">Active Directory</a> is not
running, the server MUST abort the request and return an error status.</p>
</li><li><p><span>    </span>All database operations
MUST occur in a single transaction.</p>
</li><li><p><span>    </span>Let U be the
user account with the <b>sAMAccountName</b> attribute value of UserName. The
server MUST return STATUS_WRONG_PASSWORD if no such account exists.</p>
</li><li><p><span>    </span>Let
Stored-NT-Hash be the value of the <b>unicodePwd</b> attribute from the
database decrypted using the algorithm specified in section <a href="3f5ec79d-b449-4ab2-9423-c4dccbe0b184" data-linktype="relative-path">2.2.11.1</a>, using U&#39;s <i>RelativeId</i>
as the key. If the attribute does not exist, let Stored-NT-Hash be
&#34;NULL&#34;.</p>
</li><li><p><span>    </span>Let
Stored-LM-Hash be the value of the <b>dBCSPwd</b> attribute from the database
decrypted using the algorithm specified in section 2.2.11.1, using U&#39;s <i>RelativeId</i>
as the key. If the attribute does not exist, let Stored-LM-Hash be
&#34;NULL&#34;.</p>
</li><li><p><span>    </span>If
Stored-NT-Hash is NULL and LmPresent is zero or Stored-LM-Hash is NULL, the
server MUST abort processing and return STATUS_WRONG_PASSWORD.</p>
</li><li><p><span>    </span>If
Stored-NT-Hash is not NULL, then:</p>
<ol><li><p><span>   
</span>Let Presented-Clear-Text be the cleartext value sent by the client,
obtained by decrypting <i>NewPasswordEncryptedWithOldNt</i> according to the
specification of SAMPR_ENCRYPTED_USER_PASSWORD, using Stored-NT-Hash as the
key, AND</p>
</li><li><p><span>   
</span>Let Presented-Old-NT-Hash be the value of <i>OldNtOwfPasswordEncryptedWithNewNt</i>
decrypted according to the specification of ENCRYPTED_LM_OWF_PASSWORD, using the
NT hash of Presented-Clear-Text as the key.</p>
</li></ol></li><li><p><span>    </span>If
Stored-NT-Hash is NULL, then:</p>
<ol><li><p><span>   
</span>Let Presented-Clear-Text be the cleartext value sent by the client,
obtained by decrypting <i>NewPasswordEncryptedWithOldLm</i> according to the
specification of SAMPR_ENCRYPTED_USER_PASSWORD, using Stored-LM-Hash as the
key, AND</p>
</li><li><p><span>   
</span>Let Presented-Old-LM-Hash be the value of <i>OldLmOwfPasswordEncryptedWithNewNt</i>
decrypted according to the specification of ENCRYPTED_LM_OWF_PASSWORD, using
the NT hash of Presented-Clear-Text as the key. </p>
</li></ol></li><li><p><span>    </span>Exactly one of
the two following conditions MUST be true; otherwise, the server MUST satisfy
the constraints in section <a href="11b31f55-f447-4a63-bbf7-be4c4853c23e" data-linktype="relative-path">3.1.5.14.6</a>
and return STATUS_WRONG_PASSWORD.</p>
<ol><li><p><span>   
</span>Stored-NT-Hash is non-NULL and equals Presented-Old-NT-Hash.</p>
</li><li><p><span>   
</span>Stored-NT-Hash is NULL, and Stored-LM-Hash is non-NULL and equals
Presented-Old-LM-Hash.</p>
</li></ol></li><li><p><span>  </span>The server MUST update the <b>clearTextPassword</b>
attribute with Presented-Clear-Text.</p>
</li></ol></div>