windows-xp/Source/XPSP1/NT/admin/admt/arext/setpwd/setpass.cpp

//---------------------------------------------------------------------------
// SetPass.cpp
//
// Comment: This is a COM object extension for the MCS DCTAccountReplicator.
//          This object implements the IExtendAccountMigration interface. 
//          The process method of this object sets the password for the 
//          target account according to the users specification.
//
// (c) Copyright 1995-1998, Mission Critical Software, Inc., All Rights Reserved
//
// Proprietary and confidential to Mission Critical Software, Inc.
//---------------------------------------------------------------------------
#include "stdafx.h"
#include "ResStr.h"
#include <lm.h>
#include "rpc.h"
#include "EaLen.hpp"
#include <activeds.h>
#include "ARExt.h"
#include "ARExt_i.c"
#include "ErrDCT.hpp"
#include "PWGen.hpp"
#include "TReg.hpp"

#import "DBMgr.tlb" no_namespace

StringLoader                 gString;
TErrorDct   err;

#include "SetPwd.h"
#include "SetPass.h"
#include "pwdfuncs.h"
#include "PwRpcUtl.h"
#include "PwdSvc.h"

#define AR_Status_Created           (0x00000001)

/////////////////////////////////////////////////////////////////////////////
// CSetPassword

//---------------------------------------------------------------------------
// Get and set methods for the properties.
//---------------------------------------------------------------------------
STDMETHODIMP CSetPassword::get_sName(BSTR *pVal)
{
   *pVal = m_sName;
	return S_OK;
}

STDMETHODIMP CSetPassword::put_sName(BSTR newVal)
{
   m_sName = newVal;
	return S_OK;
}

STDMETHODIMP CSetPassword::get_sDesc(BSTR *pVal)
{
   *pVal = m_sDesc;
	return S_OK;
}

STDMETHODIMP CSetPassword::put_sDesc(BSTR newVal)
{
   m_sDesc = newVal;
	return S_OK;
}

//---------------------------------------------------------------------------
// ProcessObject : This method currently records the setting of the "User
//                 cannot change password" flag for intra-forest user migrations
//---------------------------------------------------------------------------
STDMETHODIMP CSetPassword::PreProcessObject(
                                             IUnknown *pSource,         //in- Pointer to the source AD object
                                             IUnknown *pTarget,         //in- Pointer to the target AD object
                                             IUnknown *pMainSettings,   //in- Varset filled with the settings supplied by user
                                             IUnknown **ppPropsToSet    //in,out - Varset filled with Prop-Value pairs that will be set 
                                                                        //         once all extension objects are executed.
                                          )
{
/* local variables */
   IVarSetPtr  pVS = pMainSettings;
   tstring	   sSAMName = L"";

/* function body */
   _bstr_t sIntraforest = pVS->get(GET_BSTR(DCTVS_Options_IsIntraforest));
   _bstr_t sType = pVS->get(GET_BSTR(DCTVS_CopiedAccount_Type));
   _bstr_t sSrc = pVS->get(GET_BSTR(DCTVS_Options_SourceServer));
   _bstr_t sAccount = pVS->get(GET_BSTR(DCTVS_CopiedAccount_SourceSam));
   if ((!sIntraforest.length()) || (!sType.length()) || 
	   (!sSrc.length()) || (!sAccount.length()))
	   return HRESULT_FROM_WIN32(ERROR_NOT_ENOUGH_MEMORY);

   sSAMName = sAccount;
   if (!UStrICmp((WCHAR*)sIntraforest,GET_STRING(IDS_YES)))
   {
      if (!UStrICmp((WCHAR*)sType,L"user"))
      {
            //record the password flags set on the source account
         RecordPwdFlags(sSrc, sAccount);
		    //we only want to record the "User cannot change password" flag, so
		    //clear the others
		 m_bUMCPNLFlagSet = false;
		 m_bPNEFlagSet = false;

		    //store the flag setting in a map
         mUCCPMap.insert(CUCCPMap::value_type(sSAMName, m_bUCCPFlagSet));
	  }
   }
      //if previously migrated, store that time in a map
   _bstr_t sSrcDom = pVS->get(GET_BSTR(DCTVS_Options_SourceDomain));
   _bstr_t sTgtDom = pVS->get(GET_BSTR(DCTVS_Options_TargetDomain));
   IVarSetPtr		pVSMig(__uuidof(VarSet));
   IUnknown		  * pUnk;
   IIManageDBPtr	pDb(__uuidof(IManageDB));
   _variant_t		varDate;
   
   pVSMig->QueryInterface(IID_IUnknown, (void**) &pUnk);
   HRESULT hrFind = pDb->raw_GetAMigratedObject(sAccount, sSrcDom, sTgtDom, &pUnk);
   pUnk->Release();
      //if migrated previously, store that time and date in a class map
   if (hrFind == S_OK)
   {
	  varDate = pVSMig->get(L"MigratedObjects.Time");
	     //store the flag setting in a map
      mMigTimeMap.insert(CMigTimeMap::value_type(sSAMName, varDate));
   }

   return S_OK;
}
//---------------------------------------------------------------------------
// ProcessObject : This method sets the password of the target object
//                 by looking at the settings in the varset.
//---------------------------------------------------------------------------
STDMETHODIMP CSetPassword::ProcessObject(
                                             IUnknown *pSource,         //in- Pointer to the source AD object
                                             IUnknown *pTarget,         //in- Pointer to the target AD object
                                             IUnknown *pMainSettings,   //in- Varset filled with the settings supplied by user
                                             IUnknown **ppPropsToSet    //in,out - Varset filled with Prop-Value pairs that will be set 
                                                                        //         once all extension objects are executed.
                                          )
{
   _bstr_t                   sType;
   _bstr_t                   sFileName;
   IVarSetPtr                pVS = pMainSettings;
   WCHAR                     password[LEN_Path];
   bool                      bGenerate = false;
   bool                      bGenerated = false;
   DWORD                     dwMinUC = 0, dwMinLC = 0, dwMinDigits = 1, dwMinSpecial = 0, dwMaxAlpha = 10, dwMinLen = 4;
   _variant_t                var;
//   TErrorDct                 err;
   WCHAR                     fileName[LEN_Path];
   bool						 bCopiedPwd = false;
   HRESULT					 hrPwd = ERROR_SUCCESS;

   // Get the Error log filename from the Varset
   var = pVS->get(GET_BSTR(DCTVS_Options_Logfile));
   wcscpy(fileName, (WCHAR*)V_BSTR(&var));
   VariantInit(&var);
   // Open the error log
   err.LogOpen(fileName, 1);
   
   _bstr_t sXXX = GET_BSTR(DCTVS_Options_TargetServer);
   _variant_t vMach = pVS->get(sXXX);
   _variant_t vTgtName = pVS->get(GET_BSTR(DCTVS_CopiedAccount_TargetSam));

   _bstr_t sSrc = pVS->get(GET_BSTR(DCTVS_Options_SourceServer));
   _bstr_t sSrcDom = pVS->get(GET_BSTR(DCTVS_Options_SourceDomain));
   _bstr_t sMach = vMach;
   _bstr_t sTgtName = vTgtName;
   _bstr_t sAccount = pVS->get(GET_BSTR(DCTVS_CopiedAccount_SourceSam));
   _bstr_t sSkip = pVS->get(GET_BSTR(DCTVS_CopiedAccount_DoNotUpdatePassword));
   _bstr_t sTgtCN = pVS->get(GET_BSTR(DCTVS_CopiedAccount_TargetName));
   _bstr_t sIntraforest = pVS->get(GET_BSTR(DCTVS_Options_IsIntraforest));
   _bstr_t sCopyPwd = pVS->get(GET_BSTR(DCTVS_AccountOptions_CopyPasswords));
   _bstr_t sPwdDC = pVS->get(GET_BSTR(DCTVS_AccountOptions_PasswordDC));

   if ( !UStrICmp((WCHAR*)sSkip,(WCHAR*)sAccount) )
   {
      return S_OK;
   }
   
   if ( sTgtCN.length() == 0 ) 
      sTgtCN = sTgtName;
   // strip off the CN= from the beginning of the name, if necessary
   if ( !UStrICmp(sTgtCN,"CN=",3) )
   {
      sTgtCN = _bstr_t(((WCHAR*)sTgtCN)+3);
   }

   dwMaxAlpha = (LONG)pVS->get(GET_BSTR(DCTVS_AccountOptions_PasswordPolicy_MaxConsecutiveAlpha));
   dwMinDigits = (LONG)pVS->get(GET_BSTR(DCTVS_AccountOptions_PasswordPolicy_MinDigit));
   dwMinLC = (LONG)pVS->get(GET_BSTR(DCTVS_AccountOptions_PasswordPolicy_MinLower));
   dwMinUC = (LONG)pVS->get(GET_BSTR(DCTVS_AccountOptions_PasswordPolicy_MinUpper));
   dwMinSpecial = (LONG)pVS->get(GET_BSTR(DCTVS_AccountOptions_PasswordPolicy_MinSpecial));
   dwMinLen = (LONG)pVS->get(GET_BSTR(DCTVS_AccountOptions_PasswordPolicy_MinLength));

   // if the values are all 0 s then we make up something
   if ( (dwMaxAlpha + dwMinDigits + dwMinLC + dwMinUC + dwMinSpecial) == 0 ) 
   {
      dwMinDigits = 3;
      dwMinSpecial = 3;
      dwMinUC = 3;
      dwMinLC = 3;
   }

   sType = pVS->get(GET_BSTR(DCTVS_CopiedAccount_Type)).bstrVal;

      //for intra-forest migration of a user, reset the user's
      //original "User cannot change password" flag, whose value is
	  //stored in the map
   if ( ! UStrICmp((WCHAR*)sIntraforest,GET_STRING(IDS_YES)) )
   {
      if ( ! UStrICmp((WCHAR*)sType,L"user" ) )
      {
		   //get the UCCP flag from the map
         CUCCPMap::iterator		itUCCPMap;
         tstring				sSam = sAccount;
		 itUCCPMap = mUCCPMap.find(sSam);
		 if (itUCCPMap != mUCCPMap.end())
		    m_bUCCPFlagSet = itUCCPMap->second;
		 else
		    m_bUCCPFlagSet = false;
		 m_bUMCPNLFlagSet = false;
		 m_bPNEFlagSet = false;

		 ResetPwdFlags(pTarget, sMach, sTgtName);
         return S_OK;
      }
   }
   // Set the password for this account.
   if ( (_wcsicmp((WCHAR*)sType,L"user") == 0) || (_wcsicmp((WCHAR*)sType, L"computer") == 0)  )
   {
      if  ( !_wcsicmp((WCHAR*)sType,L"user" ) )
      {
			//we will not migrate passwords if replacing and password reuse policy on the target is 2 or greater
		 if (!CanCopyPassword(pVS, sSrc, sAccount))
		 {
            err.MsgWrite(0,DCT_MSG_PW_COPY_NOT_TRIED_S,(WCHAR*)sTgtCN);
			return S_OK;
		 }

         _bstr_t bstrGenerate = pVS->get(GET_BSTR(DCTVS_AccountOptions_GenerateStrongPasswords));

         if (bstrGenerate == GET_BSTR(IDS_YES))
         {
            bGenerate = true;
         }

         if (bGenerate)
         {
            // generate a strong password
            BOOL pwGeneratedRc = EaPasswordGenerate(dwMinUC, dwMinLC, dwMinDigits, dwMinSpecial, dwMaxAlpha, dwMinLen, password, LEN_Path);
            bGenerated = ( pwGeneratedRc == 0 );

            if ( !bGenerated )
               wcsncpy(password,(WCHAR*)(sTgtName),15);

            // ensure that the password is NULL terminated
            password[14] = 0;
            
         }
         else
         {
            // set the password to the first 14 characters of the username
            wcsncpy(password,(WCHAR*)(sTgtName),15);
             // Convert the password to lower case.
            
            // ensure that the password is NULL terminated
            password[14] = 0;
            
            for ( DWORD i = 0; i < wcslen(password); i++ )
               password[i] = towlower(password[i]);

            // if the password is invalid then generate a password

         // if (!IsValidPassword(password))
         // {
         //    err.MsgWrite(0, DCT_MSG_USERNAME_INVALID_FOR_PASSWORD_S, (PCWSTR)sTgtCN);

         //    EaPasswordGenerate(dwMinUC, dwMinLC, dwMinDigits, dwMinSpecial, dwMaxAlpha, dwMinLen, password, LEN_Path);

               // TODO: if password generation fails then what? Should not fail though as that would be a logic error?

         //    bGenerated = true;
         // }
         }
      }
      else
      {
         // computer, set the password to the first 14 characters of the computer name, in lower case,
         // without the trailing $
         UStrCpy(password, (WCHAR*)sTgtName, DIM(password));
         if ( password[UStrLen(password) - 1] == L'$' )
            password[UStrLen(password) - 1] = L'\0';  // remove trailing $ from machine name
         password[14] = L'\0';                     // truncate to max password length of 14
         
          // Convert the password to lower case.
          for ( DWORD i = 0; i < wcslen(password); i++ )
            password[i] = towlower(password[i]);
     
      }

//      BSTR sPassword = password;

      // We are going to use the Net API to set the password.
      USER_INFO_1003                  pInfo;
      DWORD                           pDw;
      WCHAR                           server[MAX_PATH];
	  bool							  bFailedCopyPwd = false;

	     //place the new password in the info structure
	  pInfo.usri1003_password = password;

      long rc = NetUserSetInfo((WCHAR*)sMach, 
                  (WCHAR*)sTgtName, 1003, (LPBYTE) &pInfo, &pDw);

      if ( rc != 0 ) 
	  {
         if ( bGenerated )
		 {
            err.SysMsgWrite(ErrW,rc,DCT_MSG_PW_GENERATE_FAILED_S,(WCHAR*)sTgtCN);
		 }
         else
		 {
            err.SysMsgWrite(ErrW,rc,DCT_MSG_FAILED_SET_PASSWORD_TO_USERNAME_SD,(WCHAR*)sTgtCN,rc);
            if ( rc == NERR_PasswordTooShort )
			{
               // try to generate a password
               EaPasswordGenerate(dwMinUC, dwMinLC, dwMinDigits, dwMinSpecial, dwMaxAlpha, dwMinLen, password, LEN_Path);
            
               rc = NetUserSetInfo((WCHAR*)sMach,(WCHAR*)sTgtName,1003,(LPBYTE)&pInfo,&pDw);
               if ( rc )
			   {
                  err.SysMsgWrite(ErrW,rc,DCT_MSG_PW_GENERATE_FAILED_S,(WCHAR*)sTgtCN);
			   }
               else //else complex password generated, if requested to copy password
			   {    //we now try to do that and only log that complex pwd generated if copy fails
	                 //if we are migrating the user's password, then set it here
                  if ( !UStrICmp((WCHAR*)sCopyPwd,GET_STRING(IDS_YES)) )
				  {
					    //record the password flags set on the source account
					 RecordPwdFlags(sSrc, sAccount);
					    //clear the "User cannot change password" flag if it is set
					 ClearUserCanChangePwdFlag(sMach, sTgtName);
				        //set the change password flag to get past the minimum pwd age policy
			         SetUserMustChangePwdFlag(pTarget);
		                //prepare the server name
                     server[0] = L'\\';
                     server[1] = L'\\';
                     UStrCpy(server+2,(WCHAR*)sPwdDC);
		                //call the member function to copy the password.  If success, set flag, else
					    //failed, log the generated password message
		             if ((hrPwd = CopyPassword(_bstr_t(server), sMach, sAccount, sTgtName, _bstr_t(password))) == ERROR_SUCCESS)
					 {
                        err.MsgWrite(0,DCT_MSG_PWCOPIED_S,(WCHAR*)sTgtCN);
						bCopiedPwd = true;
                           //reset the password flags as were on the source account 
					    ResetPwdFlags(pTarget, sMach, sTgtName);
					 }
					 else
					 {
						bFailedCopyPwd = true;
					 }
				  }//end if migrate password
				  else //else not copy password, so post the complex password generated message
                     err.MsgWrite(0,DCT_MSG_PWGENERATED_S,(WCHAR*)sTgtCN);
			   }
			}
		 }
	  }
      else //else success
	  {
			//if complex password generated, if requested to copy password
			//we now try to do that and only log that complex pwd generated if copy fails
         if ( bGenerated )
		 {
               //if we are migrating the user's password, then set it here
            if ( !UStrICmp((WCHAR*)sCopyPwd,GET_STRING(IDS_YES)) )
			{
				  //record the password flags set on the source account
			   RecordPwdFlags(sSrc, sAccount);
			      //clear the "User cannot change password" flag if it is set
			   ClearUserCanChangePwdFlag(sMach, sTgtName);
				  //set the change password flag to get past the minimum pwd age policy
			   SetUserMustChangePwdFlag(pTarget);
		          //prepare the server name
               server[0] = L'\\';
               server[1] = L'\\';
               UStrCpy(server+2,(WCHAR*)sPwdDC);
		          //call the member function to copy the password.  If success, set flag, else
				  //failed, log the generated password message
		       if ((hrPwd = CopyPassword(_bstr_t(server), sMach, sAccount, sTgtName, _bstr_t(password))) == ERROR_SUCCESS)
			   {
                  err.MsgWrite(0,DCT_MSG_PWCOPIED_S,(WCHAR*)sTgtCN);
			      bCopiedPwd = true;
                     //reset the password flags as were on the source account 
			      ResetPwdFlags(pTarget, sMach, sTgtName);
			   }
			   else
			   {
				  bFailedCopyPwd = true;
			   }
			}//end if migrate password
			else //else not copy password, so post the complex password generated message
               err.MsgWrite(0,DCT_MSG_PWGENERATED_S,(WCHAR*)sTgtCN);
		 }
         else
		 {
            err.MsgWrite(0,DCT_MSG_SET_PASSWORD_TO_USERNAME_S,(WCHAR*)sTgtCN);
		 }
	  }
	     //if user being migrated and that user's password was not copied, write
	     //password to the password file
	  if ((_wcsicmp((WCHAR*)sType,L"user") == 0) && (bCopiedPwd == false))
	  {
		 if ( !m_bTriedToOpenFile )
		 {
			m_bTriedToOpenFile = true;
			// we should see if the varset specifies a file name
			var = pVS->get(GET_BSTR(DCTVS_AccountOptions_PasswordFile));
			sFileName = var;
			if ( sFileName.length() > 0 )
			{
			   // we have the file name so lets open it and save the handle.
			   m_passwordLog.LogOpen(sFileName, TRUE, 1);
			}
			   //failure to get to password file so store it elsewhere and
			   //post that new file location in the migration log
			if (!m_passwordLog.IsOpen() )
			{ 
			   WCHAR sPasswordFile[MAX_PATH];
			   if (GetDirectory(sPasswordFile))//place log in default log dir
			      wcscat(sPasswordFile, L"Logs\\passwords.txt");
			   else
				  wcscpy(sPasswordFile, L"c:\\passwords.txt");
				
			   m_passwordLog.LogOpen(sPasswordFile, TRUE, 1);//open this log file
			   if ( m_passwordLog.IsOpen() )
			   {
			      if (!bFailedCopyPwd)
				     err.MsgWrite(0,DCT_MSG_NEW_PASSWORD_LOG_S,(WCHAR*)sFileName,sPasswordFile);
				  else
				     err.MsgWrite(0,DCT_MSG_NEW_PASSWORD_LOG_CPY_FAILED_S,sPasswordFile);
			   }
			}
			else if (bFailedCopyPwd)
			{
			   WCHAR sPasswordFile[MAX_PATH];
			   wcscpy(sPasswordFile, (WCHAR*)sFileName);
		       err.MsgWrite(0,DCT_MSG_NEW_PASSWORD_LOG_CPY_FAILED_S,sPasswordFile);
			}
		 }

	     // Log the new password in the password log.
	     if ( m_passwordLog.IsOpen() )
		 {
	        m_passwordLog.MsgWrite(L"%ls,%ls",(WCHAR*)(pVS->get(GET_BSTR(DCTVS_CopiedAccount_TargetSam)).bstrVal),password);
		 }
	  }//end if migrating user
   }//end if migrating user or computer

      //change password flags on the account if we did not copy the password
   if (( pTarget ) && (!bCopiedPwd))
   {
      // We want to clear "user cannot change password" and "password never expire flag"
      USER_INFO_1008               usr1008;
      USER_INFO_20               * usr20;
      DWORD                        errParam = 0;
      DWORD rc = NetUserGetInfo((WCHAR*) sSrc, (WCHAR*)sAccount, 20, (LPBYTE *)&usr20);
      _bstr_t                      strDisable = pVS->get(GET_BSTR(DCTVS_AccountOptions_DisableCopiedAccounts));
      _bstr_t                      strSame = pVS->get(GET_BSTR(DCTVS_AccountOptions_TgtStateSameAsSrc));
	  long						   val = pVS->get(GET_WSTR(DCTVS_CopiedAccount_UserFlags));
      BOOL                         bDisable = FALSE;
      BOOL                         bSame = FALSE;

      if ( ! UStrICmp(strDisable,GET_STRING(IDS_YES)) )
         bDisable = TRUE;
      if ( ! UStrICmp(strSame,GET_STRING(IDS_YES)) )
         bSame = TRUE;
      if ( !rc ) 
      {
         usr1008.usri1008_flags = usr20->usri20_flags & ~UF_DONT_EXPIRE_PASSWD;
         // we won't turn off the user cannot change password, we will just expire the password below.
         // This will lock out any account with user cannot change password set, and the admin will
         // have to manually unlock the account.
        
         //usr1008.usri1008_flags &= ~UF_PASSWD_CANT_CHANGE;
         
         // for the computer account we need to set the UF_PASSWD_NOTREQD
         if ( !_wcsicmp((WCHAR*)sType,L"computer") )
         {
            usr1008.usri1008_flags |= UF_PASSWD_NOTREQD;
            // make sure the disable state for the computer account is the same as for the source computer
            if ( usr20->usri20_flags & UF_ACCOUNTDISABLE )
            {
               usr1008.usri1008_flags |= UF_ACCOUNTDISABLE;
            }
            else
            {
               usr1008.usri1008_flags &= ~UF_ACCOUNTDISABLE;
            }
         }
         else
         {
            // for user accounts, the disable flag is set based on the disable option
            // make sure that the disable flag is set properly!
            if ((bDisable) || (bSame && (val & UF_ACCOUNTDISABLE)))
            {
               usr1008.usri1008_flags |= UF_ACCOUNTDISABLE;
            }
            else 
            {
               usr1008.usri1008_flags &= ~UF_ACCOUNTDISABLE;
            }
         }         

         NetUserSetInfo((WCHAR*) sMach, (WCHAR*) sTgtName, 1008, (LPBYTE)&usr1008, &errParam);
         NetApiBufferFree(usr20);
      }
         // Require the users to change the password at next logon since we created new passwords for them
      SetUserMustChangePwdFlag(pTarget);
   }
   err.LogClose();
   return S_OK;
}

//---------------------------------------------------------------------------
// ProcessUndo : Since we cant undo the password setting we will ignore this.
//---------------------------------------------------------------------------
STDMETHODIMP CSetPassword::ProcessUndo(                                             
                                          IUnknown *pSource,         //in- Pointer to the source AD object
                                          IUnknown *pTarget,         //in- Pointer to the target AD object
                                          IUnknown *pMainSettings,   //in- Varset filled with the settings supplied by user
                                          IUnknown **ppPropsToSet    //in,out - Varset filled with Prop-Value pairs that will be set 
                                                                     //         once all extension objects are executed.
                                       )
{
   _bstr_t                   sType;
   _bstr_t                   sSam;
   _bstr_t                   sServer;
   _bstr_t					 sIntraforest;
   WCHAR                     password[LEN_Path];
   DWORD                     rc = 0;
   DWORD                     pDw = 0;
   IVarSetPtr                pVs = pMainSettings;

   sIntraforest = pVs->get(GET_BSTR(DCTVS_Options_IsIntraforest));
   sSam  = pVs->get(GET_BSTR(DCTVS_CopiedAccount_SourceSam));
   sType = pVs->get(GET_BSTR(DCTVS_CopiedAccount_Type));
   sServer = pVs->get(GET_BSTR(DCTVS_Options_TargetServer));
   if ((!sIntraforest.length()) || (!sType.length()) || 
	   (!sSam.length()) || (!sServer.length()))
	   return HRESULT_FROM_WIN32(ERROR_NOT_ENOUGH_MEMORY);

	  //if this is user intra-forest, call preprocess the first time in and
      //precess the second
   if (!UStrICmp((WCHAR*)sIntraforest,GET_STRING(IDS_YES)))
   {
      if (!UStrICmp((WCHAR*)sType,L"user"))
      {
	        //see if this SAM is in the undone list (every entry in the list has a ","
		    //on each side of it
		 _bstr_t sTemp = _bstr_t(L",") + sSam + _bstr_t(L",");
		    //if found, that means it is post migration, so call process
	     if (wcsstr((PCWSTR)m_sUndoneUsers, sTemp))
		 {
		    ProcessObject(pSource, pTarget, pMainSettings, ppPropsToSet);
		 }
		 else //else pre-migration, so add to the list and call preprocess
		 {
			   //add to the list with an ending ","
			m_sUndoneUsers += sSam;
			m_sUndoneUsers += L",";
		    PreProcessObject(pSource, pTarget, pMainSettings, ppPropsToSet);
		 }
	  }
   }
   
   if (!_wcsicmp((WCHAR*) sType, L"computer"))
   {
      USER_INFO_1003                      buf;
      rc = 0;
      if ( !rc ) 
      {
         // Create a lower case password from the sam account name. Do not include the trailing $.
         // Password to be maximum of 14 characters.
         UStrCpy(password, (WCHAR*)sSam, DIM(password));
         if ( password[UStrLen(password) - 1] == L'$' )
            password[UStrLen(password) - 1] = L'\0';  // remove trailing $ from machine name
         password[14] = L'\0';                        // truncate to max password length of 14
         for ( DWORD i = 0; i < wcslen(password); i++ )
            password[i] = towlower(password[i]);
         buf.usri1003_password = password;
         rc = NetUserSetInfo((WCHAR*) sServer, (WCHAR*) sSam, 1003, (LPBYTE) &buf, &pDw);
         if ( rc == 2221 )
         {
            WCHAR             sam[300];
            UStrCpy(sam,(WCHAR*)sSam);

            // remove the $ from the sam account name
            sam[UStrLen(sam)-1] = 0;
            rc = NetUserSetInfo((WCHAR*) sServer, sam, 1003, (LPBYTE) &buf, &pDw);
         }
      }
   }
   return HRESULT_FROM_WIN32(rc);
}

BOOL                                       // ret - TRUE if directory found
   CSetPassword::GetDirectory(
      WCHAR                * filename      // out - string buffer to store directory name
   )
{
   DWORD                     rc = 0;
   BOOL                      bFound = FALSE;
   TRegKey                   key;


   rc = key.OpenRead(GET_STRING(IDS_HKLM_DomainAdmin_Key),HKEY_LOCAL_MACHINE);


   if ( ! rc )
   {

	   rc = key.ValueGetStr(L"Directory",filename,MAX_PATH);

	   if ( ! rc )
      {
         if ( *filename ) 
            bFound = TRUE;
      }
   }
   key.Close();


   return bFound;
}


//---------------------------------------------------------------------------
// IsValidPassword Method
//
// This method validates a password by converting the Unicode password string
// to an ANSI string.
//
// If any Unicode characters cannot be directly translated to an ANSI
// character and a default character must be used then the password is
// invalid.
//
// If any Unicode characters translate to multi-byte characters then the
// password is invalid.
//---------------------------------------------------------------------------


#ifndef WC_NO_BEST_FIT_CHARS
#define WC_NO_BEST_FIT_CHARS 0x00000400
#endif


bool CSetPassword::IsValidPassword(LPCWSTR pwszPassword)
{
	bool bValid = false;

	BOOL bUsedDefaultChar;
	CHAR szPassword[PWLEN + 1];

	// convert Unicode string to ANSI string

	int cch = WideCharToMultiByte(
		CP_ACP,						// use system ANSI code page
		WC_NO_BEST_FIT_CHARS,		// do not use best fit characters
		pwszPassword,
		-1,							// assume password string is zero terminated
		szPassword,
		sizeof (szPassword),
		NULL,
		&bUsedDefaultChar			// will be true if default character used
	);

	// if no error occurred

	if (cch > 0)
	{
		// if default character was not used

		if (bUsedDefaultChar == FALSE)
		{
			CPINFOEX cpie;
			GetCPInfoEx(CP_ACP, 0, &cpie);

			// if code page defines a SBCS then password is valid
			// otherwise code page defines a DBCS and the password
			// must be searched for a multi-byte character

			if ((cpie.LeadByte[0] == 0) && (cpie.LeadByte[1] == 0))
			{
				bValid = true;
			}
			else
			{
				// search for multi-byte character

				bool bLeadByteFound = false;

				for (int ich = 0; ich < cch; ich++)
				{
					if (IsDBCSLeadByteEx(CP_ACP, szPassword[ich]))
					{
						bLeadByteFound = true;
						break;
					}
				}

				// if no multi-byte character found
				// then password is valid

				if (!bLeadByteFound)
				{
					bValid = true;
				}
			}
		}
	}

	return bValid;
}

/*********************************************************************
 *                                                                   *
 * Written by: Paul Thompson                                         *
 * Date: 4 SEPT 2000                                                 *
 *                                                                   *
 *     This function is responsible for copying the user's password  *
 * in the source domain to its new account in the target domain.     *
 *     We use the Password Migration COM Wrapper to first check the  *
 * configuration and establish a session with the given Password     *
 * Export server.  Then we copy the password.  The configuration     *
 * check, which establishes a session for this series of operations, *
 * is only done once per set of accounts.                            *
 *                                                                   *
 *********************************************************************/

//BEGIN CopyPassword
HRESULT CSetPassword::CopyPassword(_bstr_t srcServer, _bstr_t tgtServer, _bstr_t srcName, 
								   _bstr_t tgtName, _bstr_t password)
{
/* local variables */
	HRESULT		hr = S_OK;

/* function body */

	if (m_pPwdMig == NULL)
	{
		hr = m_pPwdMig.CreateInstance(__uuidof(PasswordMigration));

		if (FAILED(hr))
		{
			return hr;
		}
	}

		//if we have not checked the password DC's configuration and
		//established a session, do it now
	if (!m_bEstablishedSession)
		hr = m_pPwdMig->raw_EstablishSession(srcServer, tgtServer);
	
		//if success, try copying the password
	if (SUCCEEDED(hr))
		hr = m_pPwdMig->raw_CopyPassword(srcName, tgtName, password);

	   //if either failed, print warning in the migration.log
	if (FAILED(hr))
	{
		IErrorInfoPtr		pErrorInfo = NULL;
		BSTR				bstrDescription;
		_bstr_t				sText = GET_BSTR(IDS_Unspecified_Failure);

			//get the rich error information on the failure
		if (SUCCEEDED(GetErrorInfo(0, &pErrorInfo)))
		{
			HRESULT hrTmp = pErrorInfo->GetDescription(&bstrDescription);
			if (SUCCEEDED(hrTmp)) //if got rich error info, use it
				sText = _bstr_t(bstrDescription, false);
		}
			//print message in the log
        err.MsgWrite(ErrW,DCT_MSG_PW_COPY_FAILED_S,(WCHAR*)tgtName, (WCHAR*)sText);
	}

	return hr;
}
//END CopyPassword


/*********************************************************************
 *                                                                   *
 * Written by: Paul Thompson                                         *
 * Date: 5 DEC 2000                                                  *
 *                                                                   *
 *     This function is responsible for setting the "User must change*
 * password at next logon" flag for a given user.  We use this prior *
 * to copying a user's password and after we have just set it to a   *
 * new complex password so that we get around the minimum password   *
 * age policy for the target domain.                                 *
 *                                                                   *
 *********************************************************************/

//BEGIN SetUserMustChangePwdFlag
void CSetPassword::SetUserMustChangePwdFlag(IUnknown *pTarget)
{
/* local variables */
   IADs  * pAds = NULL;

/* function body */
      //set the new pwdLastSet value
   HRESULT hr = pTarget->QueryInterface(IID_IADs, (void**) &pAds);
   if ( SUCCEEDED(hr) )
   {
         // Require the users to change the password at next logon since we created new passwords for them
      VARIANT var;
      VariantInit(&var);
      V_I4(&var)=0;
      V_VT(&var)=VT_I4;
      hr = pAds->Put(L"pwdLastSet",var);
      hr = pAds->SetInfo();
      VariantClear(&var);
      if ( pAds ) pAds->Release();
   }
}
//END SetUserMustChangePwdFlag


/*********************************************************************
 *                                                                   *
 * Written by: Paul Thompson                                         *
 * Date: 11 JAN 2001                                                 *
 *                                                                   *
 *     This function is responsible for setting and clearing the     *
 * "User cannot change password" flag for a given user, if it was    *
 * originally set.                                                   *
 *                                                                   *
 *********************************************************************/

//BEGIN ClearUserCanChangePwdFlag
void CSetPassword::ClearUserCanChangePwdFlag(LPCWSTR pwszMach, LPCWSTR pwszUser)
{
/* local variables */
   USER_INFO_3                   * pInfo;
   DWORD                           pDw;
   long		                       rc;

/* function body */
      //get the current flag info for this user
   rc = NetUserGetInfo(pwszMach, pwszUser, 3, (LPBYTE *)&pInfo);
   if (rc == 0)
   {
	     //clear the "User cannot change password" flag if it is set
	  if (pInfo->usri3_flags & UF_PASSWD_CANT_CHANGE)
	  {
         pInfo->usri3_flags &= !(UF_PASSWD_CANT_CHANGE);
         NetUserSetInfo(pwszMach, pwszUser, 3, (LPBYTE)pInfo, &pDw);
	  }

      NetApiBufferFree((LPVOID) pInfo);
   }
}
//END ClearUserCanChangePwdFlag


/*********************************************************************
 *                                                                   *
 * Written by: Paul Thompson                                         *
 * Date: 22 JAN 2001                                                 *
 *                                                                   *
 *     This function is responsible for recording the password flags *
 * from a given user's source domain account.                        *
 *                                                                   *
 *********************************************************************/

//BEGIN RecordPwdFlags
void CSetPassword::RecordPwdFlags(LPCWSTR pwszMach, LPCWSTR pwszUser)
{
/* local variables */
   USER_INFO_3                   * pInfo;
   long		                       rc;

/* function body */
      //get the user password flags
   rc = NetUserGetInfo(pwszMach, pwszUser, 3, (LPBYTE *)&pInfo);
   if (rc == 0)
   {
	     //record whether the "User cannot change password" flag is set
	  if (pInfo->usri3_flags & UF_PASSWD_CANT_CHANGE)
	     m_bUCCPFlagSet = true;//store whether the flag was set
      else
	     m_bUCCPFlagSet = false;

	     //record whether the "Password never expires" flag is set
	  if (pInfo->usri3_flags & UF_DONT_EXPIRE_PASSWD)
	     m_bPNEFlagSet = true;//store whether the flag was set
      else
	     m_bPNEFlagSet = false;

         //record whether the "User must change password at next logon" flag is set
	  if (pInfo->usri3_password_expired)
	     m_bUMCPNLFlagSet = true;//store whether the flag was set
      else
	     m_bUMCPNLFlagSet = false;

      NetApiBufferFree((LPVOID) pInfo);
   }
}
//END RecordPwdFlags


/*********************************************************************
 *                                                                   *
 * Written by: Paul Thompson                                         *
 * Date: 22 JAN 2001                                                 *
 *                                                                   *
 *     This function is responsible for recording the password flags *
 * from a given user's source domain account.                        *
 *                                                                   *
 *********************************************************************/

//BEGIN ResetPwdFlags
void CSetPassword::ResetPwdFlags(IUnknown *pTarget, LPCWSTR pwszMach, LPCWSTR pwszUser)
{
/* local variables */
   USER_INFO_3                   * pInfo = NULL;
   DWORD                           pDw;
   long		                       rc;

/* function body */
      //if the "User cannot change password" or "Password never expires" 
      //flag was original set, reset it
   if ((m_bUCCPFlagSet) || (m_bPNEFlagSet))
   {
         //get the current flag info for this user
      rc = NetUserGetInfo(pwszMach, pwszUser, 3, (LPBYTE *)&pInfo);
      if (rc == 0)
	  {
		 if (m_bUCCPFlagSet)
            pInfo->usri3_flags |= UF_PASSWD_CANT_CHANGE;
		 if (m_bPNEFlagSet)
            pInfo->usri3_flags |= UF_DONT_EXPIRE_PASSWD;
         NetUserSetInfo(pwszMach, pwszUser, 3, (LPBYTE)pInfo, &pDw);

         NetApiBufferFree((LPVOID) pInfo);
	  }
   }

      //if the "User must change password at next logon" flag was original set, reset it
   if (m_bUMCPNLFlagSet)
      SetUserMustChangePwdFlag(pTarget);

}
//END ResetPwdFlags


/*********************************************************************
 *                                                                   *
 * Written by: Paul Thompson                                         *
 * Date: 7 MAY 2001                                                  *
 *                                                                   *
 *     This function is responsible for determining if we will indeed*
 * set the password.  If the user is being re-migrated, copy password*
 * was selected, the password reuse policy on the target domain is   *
 * greater than 1, and the password on the source object has not been*
 * changed since the last migration of that user, then we will not   *
 * touch the password on the existing object on the target domain.   *
 *                                                                   *
 *********************************************************************/

//BEGIN CanCopyPassword
BOOL CSetPassword::CanCopyPassword(IVarSet * pVarSet, LPCWSTR pwszMach, LPCWSTR pwszUser)
{
/* local constants */
	const long		MAX_REUSE_NUM_ALLOWED = 1;

/* local variables */
	BOOL			bCanCopy = TRUE;
	_variant_t		varDate;
	USER_INFO_1   * pInfo = NULL;
	long			rc;

/* function body */
		//if not copying passwords, return TRUE
	_bstr_t sCopyPwd = pVarSet->get(GET_BSTR(DCTVS_AccountOptions_CopyPasswords));
	if (UStrICmp((WCHAR*)sCopyPwd,GET_STRING(IDS_YES)))
		return bCanCopy;

		//if not previously migrated, return TRUE
	_bstr_t sAccount = pVarSet->get(GET_BSTR(DCTVS_CopiedAccount_SourceSam));
		//get the previous migration time from the class map
	CMigTimeMap::iterator		itTimeMap;
	tstring						sSam = sAccount;
	itTimeMap = mMigTimeMap.find(sSam);
		//if previously migrated, get the date this user was last migrated
	if (itTimeMap != mMigTimeMap.end())
		varDate = itTimeMap->second;
	else //else return TRUE
		return bCanCopy;

	/* if not already done, check password reuse policy on the target domain */
	if (m_lPwdHistoryLength == -1)
	{
		IADsDomain     			* pDomain;
		_bstr_t                   sDom( L"WinNT://" );
   
		_bstr_t sTgtDom = pVarSet->get(GET_BSTR(DCTVS_Options_TargetDomain));
		sDom += sTgtDom;

		HRESULT hr = ADsGetObject(sDom, IID_IADsDomain, (void **) &pDomain);
		if (SUCCEEDED(hr))
		{
			//Get the password reuse policy
			long lReuse;
			hr = pDomain->get_PasswordHistoryLength(&lReuse);
			pDomain->Release();
				//if successful, store it in a class member variable
			if (SUCCEEDED(hr))
				m_lPwdHistoryLength = lReuse;
		}
	}
	if ((m_lPwdHistoryLength != -1) && (m_lPwdHistoryLength <= MAX_REUSE_NUM_ALLOWED))
		return bCanCopy;

	/* if target account was created, we still want to copy password if object was created (Stystus == 1) */
		//get the migration status for this user
	long lStatus = pVarSet->get(GET_BSTR(DCTVS_CopiedAccount_Status));
		//if the status field has the first bit set, then this user was
		//created and we should return TRUE to copy the password
	if (lStatus & AR_Status_Created)
		return bCanCopy;


	/* check if the source user's password has been modified since its last migration */
		//get time lapsed since last migrated	
	COleDateTime  migTime(varDate.date); //get the time last migrated
	COleDateTime  curTime = COleDateTime::GetCurrentTime(); //get the current time
	COleDateTimeSpan elapsedTime = curTime - migTime;
	DWORD migElapsed = elapsedTime.GetTotalSeconds();
		//get the time the source password was last set
	rc = NetUserGetInfo(pwszMach, pwszUser, 1, (LPBYTE *)&pInfo);
	if (rc == 0)
	{
		DWORD setElapsed = pInfo->usri1_password_age;
		NetApiBufferFree((LPVOID) pInfo);

			//if not set since last migration, set return to FALSE
		if (migElapsed < setElapsed)
			bCanCopy = FALSE;
	}

	return bCanCopy;
}
//END CanCopyPassword