Skip navigation

Why do I receive an error when I try to change an Active Directory Application Mode (ADAM) user's password?

A. By default, ADAM requires that you perform password operations over a secure channel. If you try to reset a password over a nonsecure channel (e.g., a default LDAP connection through ADSI Edit), you'll receive the error message: "Illegal modify operation. Some aspect of the modification is not permitted."

To resolve this problem, you should use an LDAP over Secure Sockets Layer (SSL) connection (which will require a certificate in place) or use the ldap_opt_encrypt option of ldp.exe to secure the connection. The ADAM Help file has information about these options under "Set or modify the password of an ADAM user" in the document's "How To" section.

If this password reset is for a test environment and not for a production system, you can disable the secure-channel requirement so that you can reset the password over a nonsecure LDAP connection via ADSI Edit. To disable the secure-channel requirement, perform these steps:

  1. Start the ADAM ADSI Edit tool (%systemroot%\ADAM\ADAM-adsiedit.msc).
  2. Right-click the root of the "ADAM ADSI Edit" navigation branch in the left hand pane of the Microsoft Management Console (MMC) and select "Connection to..."
  3. Under the Connection name, enter "Configuration partition." Enter the server name and port. If you're running ADSI Edit on the ADAM server, the server name can be localhost and the port is the value set during installation (typically 389). Under "Connect to the following node," click "Well-known naming context:" and select Configuration, as the figure shows. Click OK.
  4. Navigate to CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,CN=\{GUID of the ADAM\}.
  5. Right-click "CN=Directory Service" and select Properties.
  6. Double-click the dSHeuristics attribute.
  7. Set the value to 0000000001001 and click OK, as the figure shows.
  8. Click OK to the CN=Directory Service properties box.

You can now reset passwords over nonsecure channels; however, if this system's role changes so that it holds useful or sensitive data, you should disable the nonsecure channel ability and use one of the options specified earlier.

Hide comments


  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.