Title: I want to set "Password Must Change at Next Login" flag
Tags: c#;active-directory
Question: In my application, I am doing things that a user can control his/her local Windows User account from my app i.e. creating user, set/remove password, change password and also invoking password expiration policy is possible from my app. Now, at this point, I need to figure out If user wants to change his password at next login, then what happens. As many forums and blogs say about this, I did coding accordingly:

Invoke Password Expire at Next Login

``` public bool InvokePasswordExpiredPolicy()
    {
        try
        {
            string path = GetDirectoryPath();
            string attribute = "PasswordExpired";
            DirectoryEntry de = new DirectoryEntry(path);
            de.RefreshCache(new string[] { attribute });
            if(de.Properties.Contains("PasswordExpired"))
            de.Properties[attribute].Value = 1;
            de.CommitChanges();
            return true;
        }
        catch (Exception)
        {
            return false;
        }
    }
```

Provoke Password Expire at Next Login. Reset the flag

```public bool ProvokePasswordExpiredPolicy()
    {
        try
        {
            string path = GetDirectoryPath();
            string attribute = "PasswordExpired";
            DirectoryEntry de = new DirectoryEntry(path);
            de.RefreshCache(new string[] { attribute });
            de.Properties[attribute].Value = -1;
            de.CommitChanges();
            return true;
        }
        catch (Exception)
        {
            return false;
        }
    }
```

Checking for whether concerned flag is set or not

```public bool isPasswordPolicyInvoked()
    {
        try
        {
            string path = GetDirectoryPath();
            string attribute = "PasswordExpired";
            DirectoryEntry de = new DirectoryEntry(path);
            de.RefreshCache(new string[] { attribute });
            int value = Convert.ToInt32(de.Properties[attribute].Value);

            if (value == 1)
                return true;
            else
                return false;
        }
        catch (Exception)
        {
            return false;
        }
    }
```

I am using WinNT to get the directory path rather than LDAP. I used the following method to get the directory path.

```private String GetDirectoryPath()
    {
        String uName = this.userName;
        String mName = this.userMachine;

        String directoryPath = "WinNT://" + mName + "/" + uName;

        return directoryPath;
    }
```

is there anything I am missing? Help me out here.

Note: Firstly, I used pwdLastSet attribute to be set to 0(for on) and -1(for off) that throws an exception "Directory Property Not found in Property Cache", later I discovered that WinNT doesn't support this attribute rather it supports PasswordExpired which needs to be 1 to set the flag. That's what I did.



Here is another answer: How about using System.DirectoryServices.AccountManagement instead, in which case you can call the following code:

```UserPrincipal.Current.ExpirePasswordNow();
```

Comment for this answer: What does it do? When you set a temporary password, does it ask the user to change it when they login with the tempory password?

Here is another answer: The code below should work:  

```de.Properties["pwdLastSet"][0] = 0;
```

From User Must Change Password at Next Logon (LDAP Provider):

```
  To force a user to change their password at next logon, set the pwdLastSet attribute to zero (0). To remove this requirement, set the pwdLastSet attribute to -1. The pwdLastSet attribute cannot be set to any other value except by the system.
```


Here is another answer: I tracked this down. This corresponds to the ```UserPrincipal.LastPasswordSet``` property.

The property is read only so you have to set using these methods:

```    public bool UserMustChangePasswordNextLogon
    {
        get
        {
            return (_userPrincipal.LastPasswordSet == null);
        }
        set
        {
            if (value)
                _userPrincipal.ExpirePasswordNow();
            else
                _userPrincipal.RefreshExpiredPassword();
        }
    }
```

In my case I set variables to expire or refresh the password on next save instead of in the property setter.


{'source': 'StackExchangeDataset', 'subset': 'stackoverflow.com', 'metadata': {'AnswerCount': 4, 'CommentCount': 0, 'ContentLicense': 'CC BY-SA 3.0', 'CreationDate': '2012:00:06/27/12', 'FavoriteCount': 2.0, 'PostTypeId': 1, 'Tags': '<c#><active-directory>', 'Title': 'I want to set "Password Must Change at Next Login" flag', 'ViewCount': 16295, 'id': 11218136, 'user_AboutMe': '<p>I am a Senior Software Developer of IPDC Finance Ltd. I have been doing programming in .NET environment.</p>\n', 'user_AccountId': 1153210.0, 'user_DisplayName': 'jchoudhury', 'user_Reputation': 369.0, 'user_Views': 83.0, 'user_id': 1134487.0}}