Powershell : Force Password change for group members

I'll try to test in my lab and come up with something after the family goes to bed.

However, is your domain fucntional level at 2008?  If so you can use fine grained password policies and have a policy (PSO) apply to just a group.  It is not all or nothing like it was in 2003/2000.

Thanks

Mike

Thanks Mike .. I wish .. We have a way to go to get to functional level 2008 , still at 2003

Hi,

Check this...

Active Directory Management with PowerShell in Windows Server 2008 R2
https://www.simple-talk.com/content/print.aspx?article=868

Set-ADDefaultDomainPasswordPolicy
http://technet.microsoft.com/en-us/library/ee617251.aspx

Hope that helps  :)

Using password policies are the recommended and flawless option. But If you want to do it using PowerShell you need to schedule script to check the user on daily (or as per your requirement).. With quest AD tools, it's quiet simple..

Try something like..

Get-QADUser -MemberOf "Your Group" -PasswordNotChangedFor 90 | Set-QADUser -UserMustChangePassword $true

Select allOpen in new window

awesome .. thanks Subsun .. would it be too difficult to add the options below?

-if the account has the "password never expires" flag selected so it un checks it first?

-Script outputs a daily report of the samAccount that was forced to change the pwd?

Try...

$Users = Get-QADUser -MemberOf "Your Group" -PasswordNotChangedFor 90 -PasswordNeverExpires:$false
If ($Users -ne $null){
	$Users | Select SamAccountName | Export-Csv "C:\Temp\PasswordChangelog-$(Get-date -f dd-MM-yyy).csv" -NTI
	$Users | Set-QADUser -UserMustChangePassword $true
}

Select allOpen in new window

I didn't read..
-if the account has the "password never expires" flag selected so it un checks it first?

Check this...

$Users = Get-QADUser -MemberOf "Your Group" -PasswordNotChangedFor 90
If ($Users -ne $null){
	$Users | Select SamAccountName | Export-Csv "C:\Temp\PasswordChangelog-$(Get-date -f dd-MM-yyy).csv" -NTI
	$Users | ?{$_.PasswordNeverExpires -eq $True} | Set-QADUser -PasswordNeverExpires $false
	$Users | Set-QADUser -UserMustChangePassword $true
}

Select allOpen in new window

Hi Subsun ...

-if the account has the "password never expires" flag selected so it un checks it first?
yes .. it needs to uncheck it first or it wont work .

Did you check my last code? it should work as expected...

Hi Subsun .. It works great but if the password never expires option is checked , it does not uncheck it and forces the password change.. All other options work great !

I tried this and it did not work on accounts that had the option checked ..

$Users = Get-QADUser -MemberOf "Your Group" -PasswordNotChangedFor 90
If ($Users -ne $null){
      $Users | Select SamAccountName | Export-Csv "C:\Temp\PasswordChangelog-$(Get-date -f dd-MM-yyy).csv" -NTI
      $Users | ?{$_.PasswordNeverExpires -eq $True} | Set-QADUser -PasswordNeverExpires $false
      $Users | Set-QADUser -UserMustChangePassword $true
}

Following line should take care of it..

$Users | ?{$_.PasswordNeverExpires -eq $True} | Set-QADUser -PasswordNeverExpires $false

Select allOpen in new window

I just tested and it did uncheck the PasswordNeverExpires option..

Can you run the command against one user and see if it works?

Get-QADUser UserA | Set-QADUser -PasswordNeverExpires $false

Select allOpen in new window

hi Subsun ..

This works by itself  on one account ..
Get-QADUser UserA | Set-QADUser -PasswordNeverExpires $false


but when in the script ..it does not .. it skips those accounts that have the PasswordNeverExpires option checked ..

$Users = Get-QADUser -MemberOf "Test5" -PasswordNotChangedFor 90
If ($Users -ne $null){
      $Users | Select SamAccountName,Name,lastLogonTimestamp,PasswordLastSet | Export-Csv "e:\Projects\90\PasswordChangelog-$(Get-date -f dd-MM-yyy).csv" -NTI
      $Users | ?{$_.PasswordNeverExpires -eq $True} | Set-QADUser -PasswordNeverExpires $false
      $Users | Set-QADUser -UserMustChangePassword $true
}

Does the PasswordChangelog contains those users?

No , the log only contains the users it modified .

That means the following code is not pulling the users who set PasswordNeverExpires as $True
Get-QADUser -MemberOf "Test5" -PasswordNotChangedFor 90

What you get for..

Get-QADUser -MemberOf "Test5" -PasswordNotChangedFor 90 | ?{$_.PasswordNeverExpires -eq $True} 

Select allOpen in new window

Hi SubSun

Correct .. below does not work ..

Get-QADUser -MemberOf "Test5" -PasswordNotChangedFor 90 | ?{$_.PasswordNeverExpires -eq $True}

Check PasswordLastSet time for the accounts and see if they are 90 days old...

Get-QADUser -MemberOf "Test5" | ?{$_.PasswordNeverExpires -eq $True} | Select Name,PasswordLastSet

Select allOpen in new window

They are .. these accounts have not changed the pwd since 2008 ...

How about if we disregard the Password age and just set it so that the script checks every account in the group and unchecks the PasswordNeverExpires option if its checked ?

This does work ..

Get-QADUser -MemberOf "Test5" | ?{$_.PasswordNeverExpires -eq $True} | Set-QADUser -PasswordNeverExpires $false

A+++ thank you tons Subsun !