title: Changing Active Directory user password with PHP script
body: <p>I am trying to get a very simple <strong>PHP</strong> script to change a user <strong>password</strong> in my <strong>Active Directory</strong> domain.</p>
  
  <p>Here is the script I found some where online:</p>
  
  <pre><code>&lt;?php
  $uid = 'Mohammed Noureldin';
  $newPassword = '5omeGoodP@ssword';
  $bindDn = 'CN=Administrator,OU=UsersOU,DC=example,DC=local';
  $bindPassword = 'An0therGoodP@ssword';
  $baseDn = 'OU=UsersOU,DC=example,DC=local';
  $protocolVersion = 3;
  
  $ldap = ldap_connect('localhost');
  if (!ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, $protocolVersion))
  {
      exit('Failed to set protocol version to '.$protocolVersion);
  }
  // bind anonymously so that we can verify if the server really is running
  ldap_bind($ldap);
  if (ldap_errno($ldap) !== 0)
  {
      exit('Could not connect to LDAP server');
  }
  
  // now bind with the correct username and password
  ldap_bind($ldap, $bindDn, $bindPassword);
  if (ldap_errno($ldap) !== 0)
  {
      exit('ERROR: '.ldap_error($ldap));
  }
  
  $searchResults = ldap_search($ldap, $baseDn, 'cn='.$uid);
  // no matching records
  if ($searchResults === false)
  {
      exit('No user found');
  }
  
  if (!is_resource($searchResults))
  {
      exit('Error in search results.');
  }
  // create the unicode password
  $len = strlen($newPassword);
  $newPass = '"';
  for ($i = 0; $i &lt; $len; $i++)
  {
      $newPass .= "{$newPassword{$i}}\000";
  }
  $newPass .= '"';
  
  $entry = ldap_first_entry($ldap, $searchResults);
  if (!is_resource($entry))
  {
      exit('Couldn\'t get entry');
  }
  $userDn = ldap_get_dn($ldap, $entry);
  if (!$userDn)
  {
  exit('Errrrrrrrrr1');
  
  }
  if (!ldap_modify($ldap, $userDn, array('unicodePwd' =&gt; $newPass)))
  {
  exit(ldap_errno($ldap)." ". ldap_error($ldap));
  
  }
  ?&gt;
  </code></pre>
  
  <p>The output of this PHP page was this <strong>error</strong> message: </p>
  
  <blockquote>
    <p>53 Server is unwilling to perform</p>
  </blockquote>
  
  <p>And the script simply didn't work (the password of the user was <strong>NOT</strong> changed).</p>
  
  <p>I know the main principle that AD stores the passwords in unicodePwd field (if that is still the case till now), and I knew that I have to use <strong>secure connection and I am using it</strong> (hopfully it is correctly setup).</p>
  
  <p>I googled about that error message but I couldn't find any functional solution.</p>
  
  <p>I also tried some other scripts but this one was the best till now because the others gave me some errors in some previous steps (for example binding).</p>
  
  <p>I really appreciate any help to <strong>solve that problem</strong>, or even <strong>another functional script</strong> may be a good idea!
  Thanks in advance.</p>