title: Is it possible to authenticate an Active Directory User with an Expired password?
body: <p>I have a web form that uses AD to authenticate users. I want to be able to authenticate users with expired password, and redirect them to the password change page after authentication. </p>
  
  <p>if for instance, a site admin reset a users password, I use the method below, to make the user reset their password on next logon.</p>
  
  <pre><code>Public Shared Sub ForceUserToResetPassword(ByVal LDAP_URI As String, ByVal UserName As String, ByVal       Auth_UserName As String, ByVal Auth_Password As String)
      Dim LDAPEntry As DirectoryEntry = Nothing
      Try
          LDAPEntry = New DirectoryEntry(LDAP_URI, Auth_UserName, Auth_Password, AuthenticationTypes.Secure)
          Dim LDAPSearch As New DirectorySearcher()
          LDAPSearch.SearchRoot = LDAPEntry
          LDAPSearch.Filter = "(&amp;(objectClass=user)(sAMAccountName=" &amp; UserName &amp; "))"
  
  
          LDAPSearch.SearchScope = SearchScope.Subtree
          Dim results As SearchResult = LDAPSearch.FindOne()
          If Not (results Is Nothing) Then
              LDAPEntry = New DirectoryEntry(results.Path, Auth_UserName, Auth_Password, AuthenticationTypes.Secure)
          End If
  
          LDAPAccess.SetProperty(LDAPEntry, "pwdLastSet", 0)
          LDAPEntry.CommitChanges()
  
      Catch ex As Exception
  
      End Try
  End Sub
  </code></pre>
  
  <p>Doing this makes the user's password expire. If the user try to logon with their new password the authentication fails with "Logon failure: unknown username or bad password". </p>
  
  <p>This is my auth. method:</p>
  
  <pre><code>Public Shared Function AuthADuser(ByVal LDAP_URI As String, ByVal UserName As String, ByVal password As String, ByVal Auth_UserName As String, ByVal Auth_Password As String) As Boolean
      Dim IsAuth As Boolean = False
      Dim LDAPEntry As DirectoryEntry = Nothing
      Try
          LDAPEntry = New DirectoryEntry(LDAP_URI, UserName, password, AuthenticationTypes.Secure)
          Dim tmp As [Object] = LDAPEntry.NativeObject
          IsAuth = True
      Catch ex As Exception
          LDAPEntry.Dispose()
          If ex.Message.StartsWith("The server is not operational") Then
              IsAuth = False
          ElseIf ex.Message.StartsWith("Logon failure:") Then
              Throw New ApplicationException("The Username and password combination are not valid to enter the system.")
          End If
      Finally
          LDAPEntry.Close()
      End Try
      Return IsAuth
  End Function
  </code></pre>
  
  <p>Is there a way around this?</p>
  
  <p>Thanks for your help.</p>