title: How to validate user credentials if account is a member of AD Protected Users group?
body: <p>In my C# application I need to check/validate user name and password in an Active Directory environment. There is a Domain Controller on Windows Server 2012 R2 or higher. </p>
  
  <p>Some users are added to AD <em>Protected Users</em> group. API that is currently used does not work for such users.</p>
  
  <p>For now, the only thing that seems to work is <code>LogonUser</code> function. But it requires P/invoke.</p>
  
  <p>Is there a trick, a workaround or other API that I can use to validate user name and password for user account that is a member of the AD <em>Protected Users</em> group?</p>
  
  <p>I tried the following APIs with different options:</p>
  
  <ul>
  <li>DirectoryEntry.NativeObject.</li>
  <li>PrincipalContext.ValidateCredentials with different ContextOptions.</li>
  </ul>
  
  <pre><code>var de = new DirectoryEntry("LDAP://DomainController.lab", "test-user",
      "Test-user-password", AuthenticationTypes.Secure);
  var bo = de.NativeObject;
  </code></pre>
  
  <pre><code>var context = new PrincipalContext(ContextType.Domain, "domain");
  var res = context.ValidateCredentials("test-user", "test-user-password",
       ContextOptions.Negotiate);
  </code></pre>
  
  <p><code>DirectoryEntry.NativeObject</code> throws <code>DirectoryServicesCOMException</code> (0x8007052E) "The user name or password is incorrect".</p>
  
  <p><code>PrincipalContext.ValidateCredentials</code> simply returns FALSE.</p>