TechnitiumSoftware/DnsServer · error · InvalidOperationException

Cannot change username when using old password hash scheme.

Error message

Cannot change username when using old password hash scheme. Change password once and try again.

What it means

Thrown by User.SetUsername when the user's password is still stored using the legacy UserPasswordHashType.OldScheme. It is an InvalidOperationException because renaming is permitted in principle, but blocked while the account is on the old hash scheme — the username change must happen after a password reset upgrades the hash. This prevents corrupting legacy auth state.

Source

Thrown at DnsServerCore/Auth/User.cs:223

                    continue;

                if (throwException)
                    throw new ArgumentException("Username can contain only alpha numeric, '@', '-', '_', or '.' characters.", nameof(Username));

                return false;
            }

            return true;
        }

        #endregion

        #region internal

        internal void SetUsername(string username)
        {
            if (_passwordHashType == UserPasswordHashType.OldScheme)
                throw new InvalidOperationException("Cannot change username when using old password hash scheme. Change password once and try again.");

            IsUsernameValid(username, true);

            _username = username.ToLowerInvariant();
        }

        internal void RenameGroup(string oldName)
        {
            if (_memberOfGroups.TryRemove(oldName.ToLowerInvariant(), out Group renamedGroup))
                _memberOfGroups.TryAdd(renamedGroup.Name.ToLowerInvariant(), renamedGroup);
        }

        #endregion

        #region public

        public string GetPasswordHashFor(string password)
        {

View on GitHub (pinned to d0484b6c1e)

Solutions

1. Have the user change their password once (this migrates the hash off OldScheme), then retry the rename.
2. As administrator, force a password reset for the user to upgrade the hash, then rename.
3. Skip legacy-hash users in bulk rename and process them after they reset their password.

Example fix

// before
user.SetUsername(newUsername);

// after
if (user.PasswordHashType == UserPasswordHashType.OldScheme)
    return Error("Change password once before renaming the user.");
user.SetUsername(newUsername);

if (user.PasswordHashType == UserPasswordHashType.OldScheme)
    return Error("Change the user's password once to migrate off the old hash scheme, then rename.");
user.SetUsername(newUsername);

try { user.SetUsername(newUsername); }
catch (InvalidOperationException ex) when (ex.Message.Contains("old password hash"))
{ /* instruct password reset, then retry rename */ }

When it happens

Trigger: Calling user.SetUsername(newName) on a user whose _passwordHashType == OldScheme, i.e. an account that has not logged in / changed password since the hash scheme was upgraded.

Common situations: Renaming a long-standing user who never reset their password after a server upgrade that introduced the new hash scheme; a bulk-rename operation that does not skip legacy-hash users; importing users with their old hashes intact.

Related errors

• User account is disabled. Please contact your administrator.
• Cannot create more than 255 users.
• User already exists: {username}
• User already exists: {newUsername}
• No such user exists: {username}

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/61b4d42d1578350b. Report an issue: GitHub.