Has Windows password changed? 1

[AndyGroom]

Is it possible to either:

1. See what the current user's Windows password is (so it can be passed in the login information to check their email account), or

2. Tell whether the current user's Windows password has changed

I have written an email application but one of its problems is that when users have an Exchange account (which I connect to via IMAP/POP) and they change their Windows password every 90 days I get calls saying their email isn't working when in fact all they need to do is update the password in my email app.

So I'm after a way in which I can either add an option to my emailer along the lines of "Sign into this e-mail account using my Windows password" - in which case I'd need to be able to read the password - or a way to keep track of an encoded version of the password so that I can compare it against the previous value to tell when it has changed so I can prompt the user to update their settings.

- Andy
___________________________________________________________________
If a man speaks in a forest and there are no women around to hear him - will he still be wrong?

 

[strongm]

>See what the current user's Windows password is

No - system wouldn't be very secure if you could do that. It is possible to get hold of the hash (ie. the encoded version), but it is a pain - and you could achieve much the same effect by looking at when the password was last reset, which is easier . Here's how:

[blue]Option Explicit

Const NERR_Success = 0
Private Const NERR_BASE = 2100
Private Const NERR_InvalidComputer = (NERR_BASE + 251)
Private Const NERR_UseNotFound = (NERR_BASE + 150)
Const CP_ACP = 0
Private Type USER_INFO_3
    usri3_name As Long
    usri3_password As Long
    usri3_password_age As Long
    usri3_priv As Long
    usri3_home_dir As Long
    usri3_comment As Long
    usri3_flags As Long
    usri3_script_path As Long
    usri3_auth_flags As Long
    usri3_full_name As Long
    usri3_usr_comment As Long
    usri3_parms As Long
    usri3_workstations As Long
    usri3_last_logon As Long
    usri3_last_logoff As Long
    usri3_acct_expires As Long
    usri3_max_storage As Long
    usri3_units_per_week As Long
    usri3_logon_hours As Byte
    usri3_bad_pw_count As Long
    usri3_num_logons As Long
    usri3_logon_server As String
    usri3_country_code As Long
    usri3_code_page As Long
    usri3_user_id As Long
    usri3_primary_group_id As Long
    usri3_profile As Long
    usri3_home_dir_drive As Long
    usri3_password_expired As Long
End Type
Private Declare Function NetUserGetInfo Lib "netapi32" (lpServer As Any, Username As Byte, ByVal Level As Long, lpBuffer As Long) As Long
Private Declare Function NetApiBufferFree Lib "netapi32" (ByVal Buffer As Long) As Long
Private Declare Sub MoveMemory Lib "kernel32" Alias "RtlMoveMemory" (pDest As Any, pSource As Any, ByVal dwLength As Long)

Private Sub Command1_Click()
    Dim lpBuf As Long
    Dim ui3 As USER_INFO_3
    Dim Server() As Byte
    Dim Username() As Byte
    Server = "<servername>" & vbNullChar ' Server with AD
    Username = "<username>" & vbNullChar
    If (NetUserGetInfo(Server(0), Username(0), 3, lpBuf) = NERR_Success) Then
        Call MoveMemory(ui3, ByVal lpBuf, Len(ui3))
        MsgBox "Password age: " & ui3.usri3_password_age / 60 & " minutes" ' very simplistic, just to illustrate
        Call NetApiBufferFree(ByVal lpBuf)
    End If
End Sub[/blue]

 

[AndyGroom]

Thanks for that.

I actually went down a different route using the LogonUser API function to see whether the password they entered into the emailer matched the one in Windows, I do the check each time before I connect to the mailbox.

- Andy
___________________________________________________________________
If a man speaks in a forest and there are no women around to hear him - will he still be wrong?