ADSI SetPassword requests smart card pin

Question

I have an HTA application that I use to create users in AD. Javascript and ADSI is used.
This is working fine, I can create users, set all desired attributes etc. But if the user that executes the HTA is authenticated using a smart card, it will popup twice asking for smart card pin code. If I type the pin it works fine, likewise it does if
I just click cancel. The thing is, that it is anoying and slows things down. A users with the proper rights, but no smart card, can run the script without anything popping up.
First I bind to the AD and gets the container, then create the user as follows:
   objContainer = GetObject("LDAP://" + strContainerDN);
   objUser = objContainer.Create("user", "CN=" + strUserID);
   objUser.Put("samAccountName", strUserID);
   objUser.Put("userPrincipalName", strUserID + "@mydomain.com");
   objUser.SetInfo();
Next I set the password:
   objUser.SetPassword("xxxxxxxx");
It is the SetPassword method, that results in the popup window.
The Window looks genuine Microsoft. Says Windows Security, Microsoft Smart Card Provider, Please enter your PIN:
And next the the input box there is a smart card tile.
I am loging to a server (2008 R2) using RDP to perform the administration. Using smart cards in remote session have been enabled.
Any ideas why this Windows pops up? Apparently it is not necessary when I can just click cancel.
And any way to prevent it?  Other than disabling using smart card in remote session.
Thanks in advance,
Jan Nielsen

Answer 1

I just ran into the same problem.  I've been using the .NET classes from the System.DirectoryServices namespace (which wrap ADSI behind the scenes) in PowerShell scripts for years without
issue.  Recently, I installed the minidriver module for a new smart card on my RDP machine.  After doing that, whenever I use the DirectoryEntry.Invoke() method to call either the SetPassword or ChangePassword ADSI functions, and I don't have my
smart card plugged in, I get a prompt to insert it.  If I do have the smart card plugged in, I get a PIN prompt exactly like you describe.  Either way, clicking cancel allows the call to complete successfully.
I think what's happening here is ADSI is trying to "upgrade" its LDAP connection to use SSL/TLS whenever SetPassword or ChangePassword get called, and in the process triggering SSL/TLS
client certificate authentication.  At that point, the smart card subsystem kicks in to provide a certificate to use with said authentication, causing the prompts to appear.
The reason ADSI would try to do this is because the DC won't allow a password modify operation to occur over an unencrypted LDAP connection (see *), and ADSI must be smart enough to know this
and attempt to re-bind to the DC using SSL/TLS automatically.  Unfortunately, though, I guess when ADSI does this it doesn't distinguish between using SSL for encryption, and using it for encryption + authentication, and so the latter ends up happening
when conditions are right for it.
Fortunately, there is a workaround. 
For the System.DirectoryServices namespace, if you set the AuthenticationType property on your DirectoryEntry object ahead of time to include:
AuthenticationTypes.Secure | AuthenticationTypes.Signing | AuthenticationTypes.Sealing
then the next time the object’s properties get loaded, ADSI will bind to the DC using SASL for encryption. 
If your DC is running Server 2003 or later (see *), this will be sufficient to allow the password modify operation to succeed, and ADSI won’t try to rebind again using SSL.
For native ADSI, I’d assume passing the
ADS_SECURE_AUTHENTICATION,
ADS_USE_SIGNING, and ADS_USE_SEALING constants to the IADsOpenDSObject::OpenDSObject method (instead of calling GetObject) will achieve the same thing.
http://msdn.microsoft.com/en-us/library/cc223248(v=prot.20).aspx