Active directory user password verification from power-shell

0
votes

when i change active directory user password from Microsoft AD Users and trying to verify the credentials from Power shell script .

The problem is for some time it shows TRUE for old password and new password both then after sometime it started showing false for the old one.

No idea where it is caching.

The below command using for credentials verification but also i tried all commands available on google same result.

 $ct = [System.DirectoryServices.AccountManagement.ContextType]::Domain
 $pc = New-Object System.DirectoryServices.AccountManagement.PrincipalContext($ct, "xxxxx")
 $pc.ValidateCredentials("xxxx\myemail.abc", 12345).ToString()
1
powershellactive-directory
It's not caching. Password changes take a short time to replicate between domain controllers - you should either build in a delay or check it on the same DC that you changed it on. - Scepticalist
@Scepticalist there is only one DC - IOT Account

1 Answers

1
votes

One of two things can be happening:

  1. It can either be hitting a different DC when verifying, and the password change hasn't replicated there yet, or
  2. It could be authenticating via NTLM (instead of Kerberos), in which case, as this article describes, the old password is still valid for one hour.