Check if a password meet the current password policy

In this post I will demonstrate how to verify if a given password meet the current Windows password policy.

We will use the NetValidatePasswordPolicy API for that.

Instead of using C# pinvoke approach, we will call the API through Managed C++ then call the managed C++ DLL with C#. This approach will be much more cleaner and readable.

First, we create our Managed C++ DLL which contains our validation method :

using namespace System;

namespace pwdval
{
    public ref class srPasswordValidator
    {
        public :int ValidatePassword(System::String ^paramPassword)
        {
            pin_ptr<const wchar_t> wchDomain = PtrToStringChars(paramPassword);

            size_t convertedCharsPassword = 0;
            size_t sizeInBytesPassword = ((paramPassword->Length + 1) * 2);
            errno_t errPassword = 0;
            char    *chPassword = (char *)malloc(sizeInBytesPassword);

            errPassword = wcstombs_s(&convertedCharsPassword,
                                    chPassword, sizeInBytesPassword,
                                    wchDomain, sizeInBytesPassword);

            if (errPassword != 0)
                throw gcnew Exception("Password could not be converted");

            // first, find out the required buffer size, in wide characters
            int nPasswordSize = MultiByteToWideChar(CP_ACP, 0, chPassword, -1, NULL, 0);

            LPWSTR wPassword = new WCHAR[nPasswordSize];

            // call again to make the conversion
            MultiByteToWideChar(CP_ACP, 0, chPassword, -1, wPassword, nPasswordSize);

            NET_API_STATUS stat;
            NET_VALIDATE_PASSWORD_CHANGE_INPUT_ARG InputArg = {0};
            NET_VALIDATE_OUTPUT_ARG* pOutputArg = NULL;
            wchar_t* wzServer = 0;

            //wchar_t wzPwd = chPassword;
            InputArg.ClearPassword = wPassword;
            InputArg.PasswordMatch = TRUE;
            stat = NetValidatePasswordPolicy(wzServer, NULL, NetValidatePasswordChange, &InputArg, (void**)&pOutputArg);

            NET_API_STATUS intStatus = pOutputArg->ValidationStatus;

            NetValidatePasswordPolicyFree((void**)&pOutputArg);
            delete []wPassword;

            return intStatus;
        }

    };
}

This method returns an integer that we will convert to an Enum

enum enmResult
        {
            // <summary> 2234 - This operation is not allowed on this special group. </summary>
            SpeGroupOp = 2234,
            // <summary> 2235 - This user is not cached in user accounts database session cache. </summary>
            NotInCache = 2235,
            // <summary> 2236 - The user already belongs to this group. </summary>
            UserInGroup = 2236,
            // <summary> 2237 - The user does not belong to this group. </summary>
            UserNotInGroup = 2237,
            // <summary> 2238 - This user account is undefined. </summary>
            AccountUndefined = 2238,
            // <summary> 2239 - This user account has expired. </summary>
            AccountExpired = 2239,
            // <summary> 2240 - The user is not allowed to log on from this workstation. </summary>
            InvalidWorkstation = 2240,
            // <summary> 2241 - The user is not allowed to log on at this time. </summary>
            InvalidLogonHours = 2241,
            // <summary> 2242 - The password of this user has expired. </summary>
            PasswordExpired = 2242,
            // <summary> 2243 - The password of this user cannot change. </summary>
            PasswordCantChange = 2243,
            // <summary> 2244 - This password cannot be used now. </summary>
            PasswordHistConflict = 2244,
            // <summary> 2245 - The password does not meet the password policy requirements. Check the minimum password length, password complexity and password history requirements. </summary>
            PasswordTooShort = 2245
        }

You can find the complete enum definition in the sources downloadable at the end of the post.

Here is now hows we use the DLL to validate a password :

        private object pwValidator;

        public PwdVal()
        {
            foreach (string curModule in Directory.GetFiles(ModuleSearchPath, "srPasswordValidator.dll"))
            {
                try
                {
                    Assembly objAssembly = Assembly.LoadFile(curModule);
                    System.Type objType = objAssembly.GetType("pwdval.srPasswordValidator");

                    if ((objType != null))
                    {
                        pwValidator = Activator.CreateInstance(objType);

                        break;
                    }
                }
                catch (Exception ex)
                {
                    pwValidator = null;
                }
            }
        }

        private string ModuleSearchPath
        {
            get { return Path.GetDirectoryName(Assembly.GetExecutingAssembly().Location); }
        }

        public bool ValidatePassword(string paramPassword, ref string paramReason)
        {
            try
            {
                if (pwValidator == null)
                {
                    paramReason = "Could not validate the password - pwValidator is NULL";
                    return false;
                }

                object obj = pwValidator.GetType().GetMethod("ValidatePassword").Invoke(pwValidator, new object[] { paramPassword });

                if (obj == null)
                {
                    paramReason = "Could not validate the password - obj is NULL";
                    return false;
                }

                int val = Int32.Parse(obj.ToString());

                enmResult intResult = (enmResult)val;

                paramReason = intResult.ToString();

                return intResult == enmResult.Success;
            }
            catch (Exception ex)
            {
                paramReason = ex.Message;
                return false;
            }
        }

You can download sources and sample here : http://dl.free.fr/q04LOHSpM