Admin Server password not working

Question

Running Netscape Directory Server 4.1 on Solaris 9.
I see this:
[root@arthur]> ldapsearch -D "cn=Directory Manager" -w ******** -b o=netscaperoot "cn=admin-serv-arthur" passwordexpirationtime
cn=admin-serv-arthur, cn=Netscape Administration Server, cn=Server Group, cn=arthur.cusys.edu, ou=cusys.edu, o=NetscapeRoot
passwordexpirationtime=20060215123431
But when I try to modify via:
[root@arthur]> ldapmodify -D "cn=Directory Manager" -w ******** -f pwexptime.ldif
where pwexptime.ldif is:
dn: cn=admin-serv-arthur, cn=Netscape Administration Server, cn=Server Group,
cn=arthur.cusys.edu, ou=cusys.edu, o=NetscapeRoot
chnagetype:modify
replace:passwordexpirationtime
passwordexpirationtime: 20090215123431
I get:
modifying entry cn=admin-serv-arthur, cn=Netscape Administration Server, cn=Server Group,cn=arthur.cusys.edu, ou=cusys.edu, o=NetscapeRoot
ldap_modify_s: Object class violation
I can't find passwordexpirationtime as an attribute for any of the associated admin-serv-arthur object classes, thus the object class violation. Then where did it come from in the ldapsearch above?
How do I change this passwordexpirationtime attribute?

Answer 1

What about changing the password of this account itself.
AFAICR (as this werver is quite out-of-date) passwordexirationtime is a operational attribute set by the server itself.
Read out userpassword with ldapsearch.
use ldapmodify to changeit to some value
use ldapmodify again to set it back to the old value.
General advice:
It seems you�re using a password policy.
As this old server does not have scoped password policies (like the new server does) you should set up a separate Directory Server instance which holds the "o=netscapeRoot" tree. This one is called the configuration directory server - and it's best practice to have it as a different instance.
-Bernhard
Of course ugrading to Directory Server 5.2 is adviced as well because the version you are using is already end of support live.