title: "The specified network password is not correct." exception when changing a users password
body: <p>I am running an ASP.NET application that changes a user's password. The PasswordException "The specified network password is not correct." is getting thrown every time the ChangePassword method is called, even when the current password has been validated.</p>
  
  <p>If I enter in an invalid current password, the exception gets thrown. This is the expected result.</p>
  
  <p>If I enter in a <strong>valid current password</strong>, the exception gets thrown, <strong>but the password still gets changed</strong> (I've tested validating it immediately after the change).</p>
  
  <p>The code is very simple:</p>
  
  <pre><code>var context = new PrincipalContext(ContextType.Domain, "domain.net");
  var valid = context.ValidateCredentials(username, oldPassword);
  var userPrincipal = UserPrincipal.FindByIdentity(context, username);
  userPrincipal.ChangePassword(oldPassword, newPassword);
  </code></pre>
  
  <p>This results in the following exception being thrown every time, regardless if the current password is correct or not:</p>
  
  <pre><code>System.DirectoryServices.AccountManagement.PasswordException: The specified network password is not correct. (Exception from HRESULT: 0x80070056) ---&gt; System.Runtime.InteropServices.COMException: The specified network password is not correct. (Exception from HRESULT: 0x80070056)
   --- End of inner exception stack trace ---
   at System.DirectoryServices.AccountManagement.SDSUtils.ChangePassword(DirectoryEntry de, String oldPassword, String newPassword)
   at System.DirectoryServices.AccountManagement.ADStoreCtx.ChangePassword(AuthenticablePrincipal p, String oldPassword, String newPassword)
   at StudentAccountManager.ChangeUserPassword(String username, String oldPassword, String newPassword)
  </code></pre>
  
  <p>Useful information:</p>
  
  <ul>
  <li>The domain that the website is hosted on (ex. webdomain.net) is a different domain than the password change is being done against.</li>
  <li>There are three domain controllers in domain.net, one of which is read only.</li>
  <li>Two of the domain controllers are on-site. The other is off-site. The PDC is on-site.</li>
  <li>If any of the specific domain controllers (ex. dc1.domain.net, dc2.domain.net) is used in the PrincipalContext, everything works fine (all three have been tested).</li>
  <li>The userPrincipal.SetPassword method works correctly when domain.net is specified in the PrincipalContext.</li>
  <li>The user account running the application pool has permissions to change and set the password on domain.net</li>
  <li>There is a one way trust between the domains (domain.net trusts webdomain.net)</li>
  <li>The web server is running Windows Server 2012 R2, the domain controllers on domain.net are Windows Server 2008 R2</li>
  </ul>
  
  <p>My best guess is that there is a timing issue with a credential validation and the change password request being sent. Is it possible that the new credentials are being validated against a domain controller that hasn't received the request to change the password? This would result in the exception being thrown, but the password still being changed.</p>