How to validate user credentials if account is a member of AD Protected Users group?

[Oleksii Diachok]

Hi.

What API can I use to validate user name and password if user is a member of the AD Protected Users group on Windows Server 2012 R2 or higher.

I tried using:

1. DirectoryEntry.NativeObject
   
2. PrincipalContext.ValidateCredentials with different ContextOptions.

DirectoryEntry.NativeObject throws DirectoryServicesCOMException (0x8007052E) "The user name or password is incorrect".

PrincipalContext.ValidateCredentials simply returns FALSE.

Both APIs work fine if I remove user from AD "Protected Users" group.

According to this article accounts that are members of the Protected Users group that authenticate to a Windows Server 2012 R2 domain are unable to:

1. Authenticate with NTLM authentication.
2. Use DES or RC4 encryption types in Kerberos pre-authentication.

Probably, neither DirectoryEntry.NativeObject nor PrincipalContext.ValidateCredentials support Kerberos protocol. Or I miss something.

For now, the only thing that seems to work is LogonUser function. But it requires P/invoke.

Is there a trick, a workround or other API that I can use to validate user name and password for user account that is a member of the Protected Users group?

Continue reading...