Solved

How to get Powershell to return

Posted on 2011-02-14
7
660 Views
Last Modified: 2012-08-13
Experts,
 
         Attached below I have a script that we run in our test LAB. The script should do the following:
1. Search for a user and return password information
2. Ask user if they want to reset the users password based on the info returned
3. Take the user's response and either change the users password or exit script
4. Password activity should be written out to text file.

Thanks, Missymadi
$user = read-host "Enter UserName"
Get-qaduser $User | Select PasswordLastSet, PasswordAge,PasswordExpires, PasswordNeverExpires, UserMustChangePassword, PasswordIsExpired, PasswordStatus 
$User = read-host "Do you want to reset a user's password?"
$strResponse = Read-Host "[1] Yes, [2] No"

If ($strResponse -eq "1" )

{$users = get-qaduser -samaccountname USERNAME 
$users | %{
set-qaduser -Userpassword 'Test'
get-qaduser -samaccountname $_.samaccountname | Select samaccountname, passwordlastset | out-file c:\PwdChanged.txt -noclobber
}

   else{Write-Host "Exiting Search Script"}
}

Open in new window

0
Comment
Question by:missymadi
  • 4
  • 3
7 Comments
 
LVL 71

Expert Comment

by:Chris Dent
ID: 34890570
You're not far off it really.

Chris
# Ask for a username

$Username = Read-Host "Enter UserName"

# Search for the user(s)

$Users = Get-QADUser -SamAccountName $Username | Select-Object Name, DN, 
  PasswordLastSet, PasswordAge,PasswordExpires, PasswordNeverExpires, 
  UserMustChangePassword, PasswordIsExpired, PasswordStatus

# Display the user(s)

$Users

# Ask if they wish to proceed

$Response = Read-Host "Do you want to reset a user's password?`n[1] Yes, [2] No"

# Do the work

If ($Response -eq "1" ) {
  # For each user we found earlier, set the password. Log a few things and the name of the 
  # user running this script 

  $Users | ForEach-Object { Set-QADUser $_.DN -UserPassword 'Test' } |
    Select-Object SamAccountName, PasswordLastSet, @{n='SetBy';e={ $Env:Username }} |
    Out-File c:\PwdChanged.txt -Append
}

Open in new window

0
 

Author Comment

by:missymadi
ID: 34892328
Thanks! Worked for me.
I need to tell the user at the end of the script that the password has been changed. What is the syntax to do that?

Thanks, Missymadi
0
 
LVL 71

Expert Comment

by:Chris Dent
ID: 34894727

We could add in something to tell us about that. Is this what you had in mind?

Chris
# Ask for a username

$Username = Read-Host "Enter UserName"

# Search for the user(s)

$Users = Get-QADUser -SamAccountName $Username | Select-Object Name, DN, 
  PasswordLastSet, PasswordAge,PasswordExpires, PasswordNeverExpires, 
  UserMustChangePassword, PasswordIsExpired, PasswordStatus

# Display the user(s)

$Users

# Ask if they wish to proceed

$Response = Read-Host "Do you want to reset a user's password?`n[1] Yes, [2] No"

# Do the work

If ($Response -eq "1" ) {
  # For each user we found earlier, set the password. Log a few things and the name of the 
  # user running this script 

  $Users | ForEach-Object { 
    Set-QADUser $_.DN -UserPassword 'Test'
    Write-Host "Password reset for $($_.Name)"
  } | Select-Object SamAccountName, PasswordLastSet, @{n='SetBy';e={ $Env:Username }} |
    Out-File c:\PwdChanged.txt -Append
}

Open in new window

0
What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.

 

Author Comment

by:missymadi
ID: 34899816
It works great.
How would I  prompt the user to enter their own made up AD passwordm instead of letting the script hardcode the password. What is the syntax to accept a new password and save to AD?

Thanks, Missymadi
0
 
LVL 71

Expert Comment

by:Chris Dent
ID: 34899892

The password is just clear text here, so you could always have another Read-Host prompt if that's what you're after :)

Unfortunately we can't easily use the -AsSecureString option which gives you *** as you're typing instead of displaying the typed password. If we did, we'd have to use a rather complex command to get the plain text password back out of it.

Chris
# Ask for a username

$Username = Read-Host "Enter UserName"

# Search for the user(s)

$Users = Get-QADUser -SamAccountName $Username | Select-Object Name, DN, 
  PasswordLastSet, PasswordAge,PasswordExpires, PasswordNeverExpires, 
  UserMustChangePassword, PasswordIsExpired, PasswordStatus

# Display the user(s)

$Users

# Ask if they wish to proceed

$Response = Read-Host "Do you want to reset a user's password?`n[1] Yes, [2] No"

# Ask fora  password to use

$Password = Read-Host "Please enter a password to use"

# Do the work

If ($Response -eq "1" ) {
  # For each user we found earlier, set the password. Log a few things and the name of the 
  # user running this script 

  $Users | ForEach-Object { 
    Set-QADUser $_.DN -UserPassword $Password
    Write-Host "Password reset for $($_.Name)"
  } | Select-Object SamAccountName, PasswordLastSet, @{n='SetBy';e={ $Env:Username }} |
    Out-File c:\PwdChanged.txt -Append
}

Open in new window

0
 

Author Comment

by:missymadi
ID: 34900343
Great. One more thing I thought of ...what if the password is fat-fingered. How can I force user to type in twice then make sure the two match?

Thanks, Missymadi
0
 
LVL 71

Accepted Solution

by:
Chris Dent earned 500 total points
ID: 34900431
Ahh good point. This is a possibility.
# Ask for a username

$Username = Read-Host "Enter UserName"

# Search for the user(s)

$Users = Get-QADUser -SamAccountName $Username | Select-Object Name, DN, 
  PasswordLastSet, PasswordAge,PasswordExpires, PasswordNeverExpires, 
  UserMustChangePassword, PasswordIsExpired, PasswordStatus

# Display the user(s)

$Users

# Ask if they wish to proceed

$Response = Read-Host "Do you want to reset a user's password?`n[1] Yes, [2] No"

# Ask fora  password to use

$Password1 = Read-Host "Please enter a password to use"
$Password2 = Read-Host "Please re-enter the password to confirm"

If ($Password1 -ne $Password2) {

  Write-Host "Passwords do not match. Aborting script." -ForegroundColor Red

} Else {

  # Do the work

  If ($Response -eq "1" ) {
    # For each user we found earlier, set the password. Log a few things and the name of the 
    # user running this script 

    $Users | ForEach-Object { 
      Set-QADUser $_.DN -UserPassword $Password1
      Write-Host "Password reset for $($_.Name)"
    } | Select-Object SamAccountName, PasswordLastSet, @{n='SetBy';e={ $Env:Username }} |
      Out-File c:\PwdChanged.txt -Append
  }
}

Open in new window

Chris
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Windows 10 came with  a lot of built in applications, Some organisations leave them there, some will control them using GPO's. This Article is useful for those who do not want to have any applications in their image (example:me).
A quick Powershell script I wrote to find old program installations and check versions of a specific file across the network.
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …
Attackers love to prey on accounts that have privileges. Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …

685 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question