We are not able to set customized passwordFilter in windows 10 - c++

Question

I created my own password filter.dll, but I am not able to set it into Windows system.
I appended it under LSA->Notificationpackage, and I copied into c:\Window\System32 as well.
In my password filter, at start I created the log file, but it is not creating it.
Please let me know is there are any more steps I need to perform to set my password filter in Windows 10.
Please find this snippet of my password filter:
#include <regex>
#include <fstream>
#include "Ntsecapi.h"
#define MAX_SIZE 4028
using namespace std;
using namespace std::tr1;
fstream writeLog;
BOOLEAN __stdcall InitializeChangeNotify(void)
{
wchar_t *pLogFile = L"c:\AmitPasswordFilter.log";
wchar_t aLogFileExp[64];
ExpandEnvironmentStrings(pLogFile, aLogFileExp, sizeof(aLogFileExp)/sizeof(wchar_t));
writeLog.open(aLogFileExp, ios::out|ios::app);
writeLog<<"InitializeChangeNotify"<<endl;
return TRUE;
}
BOOLEAN __stdcall PasswordFilter(PUNICODE_STRING AccountName, PUNICODE_STRING FullName, PUNICODE_STRING Password, BOOLEAN SetOperation)
{
writeLog<<"BabaPasswordFilter"<<endl;
writeLog<< "PasswordFilterAmit"<<endl;
wcmatch mr;
BOOL match = FALSE;
std::wstring seperator(L")(?=");
std::wstring regExp(L"(?=");
const int cathegories=4;
unsigned int aRegCondition[cathegories]={2,2,2,2};
for(int i=0;i<cathegories;i++)
{
for(int i=0;i<aRegCondition[0];i++)
regExp+=L".*\\d";
regExp+=seperator;
for(int i=0;i<aRegCondition[1];i++)
regExp+=L".*\\W";
regExp+=seperator;
for(int i=0;i<aRegCondition[2];i++)
regExp+=L".*[A-Z]";
regExp+=seperator;
for(int i=0;i<aRegCondition[3];i++)
regExp+=L".*[a-z]";
regExp+=L")(?![.\\n]).*$";// check for newline characters and end
wregex rx(regExp);
if (Password)
{
match = regex_search(Password->Buffer, mr, rx);
if (match)
{
match = TRUE;
writeLog<<"SumitPassword matches the complexity"<<endl;
}
else
{
match = FALSE;
writeLog<<"SumitPassword does not matche the complexity"<<endl;
}
}
else
{
writeLog<<"SumitPassword is NULL"<<endl;
}
return match;
}

Answer 1

Does your domain password policy, do you have "Passwords must meet complexity requirements" enabled? Per Microsoft's documentation on enabling a custom password filter, this policy needs to be enabled for the password filter to be applied (when we implemented our password filter five or so years ago, I confirmed the policy was required too).
If you've got the complexity policy enabled, run a remote debugging session against LSASS.EXE (in WinDBG, you need to close the debugging session with 'qd' {quit and detach} otherwise lsass.exe terminates unexpectedly and your computer is all sorts of messed up until it reboots).
I would recommend not putting anything under InitializeChangeNotify unless you have thorough exception handling. Exceptions occurring through this call can create wide-spread issues. My InitializeChangeNotify is simply a return true ... which is accurate since my filter has a separate service which applies the business logic to test password validity -- if my DLL is up enough to respond to InitializeChangeNotify, then it is up.
For reference, my PasswordFilter function:
extern "C" __declspec(dllexport) BOOLEAN __stdcall PasswordFilter(PUNICODE_STRING AccountName,
PUNICODE_STRING FullName,
PUNICODE_STRING Password,
BOOLEAN SetOperation) {
//build the account struct
PasswordFilterAccount *pfAccount = new PasswordFilterAccount();
pfAccount->AccountName = AccountName;
pfAccount->Password = Password;
//start an asynchronous thread to be able to kill the thread if it exceeds the timout
HANDLE pfHandle = (HANDLE)_beginthreadex(0, 0, CreateSocket, (LPVOID *)pfAccount, 0, 0);
// timeout is milliseconds. Is 30 seconds too long?
DWORD dWaitFor = WaitForSingleObject(pfHandle, 30000); //do not exceed the timeout.
if (dWaitFor == WAIT_TIMEOUT) {
//timeout exceeded
writeWindowsEventLog("Timeout exceeded", "OPF", "ERROR", 5);
}
else if (dWaitFor == WAIT_OBJECT_0) {
//here is where we want to be
}
else {
//WAIT_ABANDONED
//WAIT_FAILED
writeWindowsEventLog("WAIT abandoned or failed", "OPF", "ERROR", 5);
}
if (pfHandle != INVALID_HANDLE_VALUE && pfHandle != 0) {
if (CloseHandle(pfHandle)) {
pfHandle = INVALID_HANDLE_VALUE;
}
}
return bPasswordOk;
}