Hi Derek.

This is a great post. Unhelpful error messages are a persistent thorn in my personal productivity, both as a user and as a developer.

This reminds me of a past project where I used a Web Form to allow the user to change their Active Directory password. The code I used was something like this:

Dim oldPassword As String = Request.Form("txtOldPassword")
Dim newPassword As String = Request.Form("txtNewPassword")

' Get the user's AD account
Dim deUser As New DirectoryEntry()
Dim dsUser As New DirectorySearcher(deUser, "SAMAccountName=" & CurrentUser("lanID"))
Dim adUser As SearchResult = dsUser.FindOne()

Try

' Attempt to change the password. Restrictions will be applied by AD
' (password length, history, etc) as defined by the domain password policy.
Dim deUserEntry As DirectoryEntry = dsUser.GetDirectoryEntry()
deUserEntry.Invoke("ChangePassword", New Object() {oldPassword, newPassword})
deUserEntry.CommitChanges()

' Redirect to confirmation page.
Response.Redirect("passwordSuccessfullyChanged.aspx")

Catch ex As Exception

' Display the error to the user
lblError.InnerText = ex.InnerException.Message

End Try


As it applies specfically to your post, if a password change attempt failed, I was unable to determine which item in the password policy had been violated. I would just get a generic Active Directory message about "failed to meet policy conditions" or something (I don't remember the exact message). Naturally, the AD policy in place at the time also had the "can only change password once per day" restriction and this caused me no end of grief with users who, just as you described, recently had their passwords reset by the help desk and were now trying to change it themselves. I never was able to find a solution to this problem.

Very frustrating.


Cheers,
Andre