"The specified network password is not correct." exception when changing a users password
<p>I am running an ASP.NET application that changes a user's password. The PasswordException "The specified network password is not correct." is getting thrown every time the ChangePassword method is called, even when the current password has been validated.</p>

<p>If I enter in an invalid current password, the exception gets thrown. This is the expected result.</p>

<p>If I enter in a <strong>valid current password</strong>, the exception gets thrown, <strong>but the password still gets changed</strong> (I've tested validating it immediately after the change).</p>

<p>The code is very simple:</p>

<pre><code>var context = new PrincipalContext(ContextType.Domain, "domain.net");
var valid = context.ValidateCredentials(username, oldPassword);
var userPrincipal = UserPrincipal.FindByIdentity(context, username);
userPrincipal.ChangePassword(oldPassword, newPassword);
</code></pre>

<p>This results in the following exception being thrown every time, regardless if the current password is correct or not:</p>

<pre><code>System.DirectoryServices.AccountManagement.PasswordException: The specified network password is not correct. (Exception from HRESULT: 0x80070056) ---&gt; System.Runtime.InteropServices.COMException: The specified network password is not correct. (Exception from HRESULT: 0x80070056)
 --- End of inner exception stack trace ---
 at System.DirectoryServices.AccountManagement.SDSUtils.ChangePassword(DirectoryEntry de, String oldPassword, String newPassword)
 at System.DirectoryServices.AccountManagement.ADStoreCtx.ChangePassword(AuthenticablePrincipal p, String oldPassword, String newPassword)
 at StudentAccountManager.ChangeUserPassword(String username, String oldPassword, String newPassword)
</code></pre>

<p>Useful information:</p>

<ul>
<li>The domain that the website is hosted on (ex. webdomain.net) is a different domain than the password change is being done against.</li>
<li>There are three domain controllers in domain.net, one of which is read only.</li>
<li>Two of the domain controllers are on-site. The other is off-site. The PDC is on-site.</li>
<li>If any of the specific domain controllers (ex. dc1.domain.net, dc2.domain.net) is used in the PrincipalContext, everything works fine (all three have been tested).</li>
<li>The userPrincipal.SetPassword method works correctly when domain.net is specified in the PrincipalContext.</li>
<li>The user account running the application pool has permissions to change and set the password on domain.net</li>
<li>There is a one way trust between the domains (domain.net trusts webdomain.net)</li>
<li>The web server is running Windows Server 2012 R2, the domain controllers on domain.net are Windows Server 2008 R2</li>
</ul>

<p>My best guess is that there is a timing issue with a credential validation and the change password request being sent. Is it possible that the new credentials are being validated against a domain controller that hasn't received the request to change the password? This would result in the exception being thrown, but the password still being changed.</p>