---
title: Change Active Directory password
summary: Resets a named user's Active Directory password and optionally records who made the change.
status: draft
owner: SAIF
last_reviewed: 2026-07-30
library: SAIF.Business.Security.SystemUser
reference_type: package
operation_id: OP-SU-06
trigger: Caller calls clsSystemUser.ChangePassword(inUserId, inNewPwd, [inUpdatedBy])
---

# Change Active Directory password

`ChangePassword` resets the AD password for a named user identified by user ID — independent of whatever account `m_DirUser` currently references — and optionally stamps the account's `Comment` attribute with the identity of who made the change.

| Field | Value |
| --- | --- |
| **Operation ID** | OP-SU-06 |
| **Trigger** | Caller calls `clsSystemUser.ChangePassword(inUserId, inNewPwd, [inUpdatedBy])` |
| **Inputs** | `inUserId` target user ID; `inNewPwd` new password value; optional `inUpdatedBy` updater identity |
| **Outputs** | `Boolean` result; updated AD password and, when supplied, updated `Comment` attribute |
| **Primary components** | `clsSystemUser.ChangePassword(...)` |
| **Entry point** | `Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb` |

## Steps

1. **Resolve the target user.** `ChangePassword` calls `m_DirServer.GetUser(inUserId)` to locate the account, independent of the object's own `m_DirUser` context.
2. **Handle a failed lookup.** If the user cannot be found, `isValid` is set to `False` and no password change is attempted.
3. **Set the new password.** If the user is found, a `Try` block invokes `thisUser.m_DirEntry.Invoke("SetPassword", inNewPwd)`.
4. **Record the updater.** If `inUpdatedBy` is not empty, `thisUser.Comment` is set to that value in the same `Try` block.
5. **Handle a failed password set.** If `SetPassword` (or the `Comment` assignment) raises an exception, it is caught and re-thrown as `ApplicationException("Unable to set password.", ex)` — the caller receives a wrapped exception rather than a `False` return for this failure path.
6. **Commit unconditionally.** Regardless of whether the `Try` block succeeded or threw, the `Finally` block calls `thisUser.m_DirEntry.CommitChanges()`.
7. **Return the outcome.** The method returns `isValid`. Note that `isValid` is only ever explicitly set to `False` (step 2, when the user is not found); it is never set to `True` on the success path, so a successful password reset also returns `False` unless the caller lookup failed.*

## Process flow

The following diagram visualizes this operation's control flow.

```mermaid
flowchart TD
	Start([Caller calls ChangePassword]) --> Lookup[m_DirServer.GetUser inUserId]
	Lookup --> Found{User found?}
	Found -->|No| Fail([isValid = False; return False])
	Found -->|Yes| SetPwd[Invoke SetPassword with inNewPwd]
	SetPwd --> UpdatedBy{inUpdatedBy supplied?}
	UpdatedBy -->|Yes| SetComment[Set Comment to inUpdatedBy]
	UpdatedBy -->|No| Commit
	SetComment --> Commit[Finally: CommitChanges]
	SetPwd -.exception.-> Throw[Throw ApplicationException]
	Commit --> Return([Return isValid - always False on this path*])
```

## Failure and edge-case behavior

- `ChangePassword` returns `False` for both a "user not found" outcome and a successful password reset, because the `isValid` variable is never assigned `True` anywhere in the method; callers cannot distinguish success from a not-found condition using the return value alone.*
- A failure during `SetPassword` throws an `ApplicationException` rather than returning `False`, so callers must handle both a thrown exception and a `False` return to fully cover this method's failure modes.
- `CommitChanges()` runs in the `Finally` block even when `SetPassword` threw, so a partially-applied `Comment` change (if it executed before the exception) may still be committed.*
- The method operates on any user resolvable by `inUserId`, not just the object's currently loaded `m_DirUser` — it does not require [Switch active user context](switch-active-user-context.md) to have been called first.

## Related documentation

- [Operations and processes](../operations-processes.md)
- [Business rules](../business-rules.md)

> **Note:** Statements marked with `*` were inferred from code structure, naming
> conventions, or contextual evidence where direct confirmation was not available
> in source artifacts.

## Sources

- `Business\SAIF.Business.Security.SystemUser\clsSystemUser.vb`