Start-TssSecretChangePassword Access Issue

[AustinBrownMCU]

I am attempting to use the Start-TssSecretChangePassword cmdlet to push a new password to one of our secrets. I'm able to retrieve the secret that I want, as well as read any of the properties that I request including the password. However, when I run my password change I receive an error stating "Access denied changing the password".

$tssSession = New-TssSession -SecretServer $baseUri -UseWindowsAuth
$secret = Get-TssSecret -TssSession $tssSession -Id $id
$SecurePass = ConvertTo-SecureString $newPassword -AsPlainText -Force
Start-TssSecretChangePassword -TssSession $tssSession -Id $id -Type "Manual" -NextPassword $SecurePass

I am using an application user to authenticate to Secret Server, and the application user is an owner of both the secret that I am attempting to update as well as its folder. Any thoughts to what my issue might be?

[wsmelton]

Can you perform the change password operation from the UI on that Secret?

[AustinBrownMCU]

I ended up solving my issue using Set-TssSecretField and passing a new password

Set-TssSecretField -TssSession $tssSession -Id $id -Slug 'password' -Value $newPassword

[wsmelton]

That method will not update the source system for that credential. It is only updating the Password field on the Secret itself. It will cause the HB to fail if the source system for that account (e.g. Active Directory) is not also updated. (Unless that is the intention.)

[AustinBrownMCU]

Thank you. I think I was misunderstanding the purpose of the Start-TssSecretChangePassword cmdlet. I thought it was to change any secret, but from your original response it seems that it is targeting at the secrets that have the "Change password now" button at the top of the secret page.

I was attempting to change the password on a secret that doesn't support remote password changing.