Force all staff to reset passwords with specific requirements

To list who has an old password:

$Cutoff = $((Get-Date).AddDays(-7).ToFileTimeUtc())
Get-ADUser -filter {(employeeID -ge "100000") -and (employeeID -lt "500000") -and (pwdLastSet -lt $Cutoff) -and (pwdLastSet -ne "0") -and (EmailAddress -like "*")} -Properties DisplayName,EmailAddress,SamAccountName,distinguishedName | Sort-Object EmailAddress | FT DisplayName,EmailAddress,SAMAccountName,distinguishedName

Select all Open in new window

To force the user to reset their password at next logon:

$Cutoff = $((Get-Date).AddDays(-7).ToFileTimeUtc())
Get-ADUser -filter {(employeeID -ge "100000") -and (employeeID -lt "500000") -and (pwdLastSet -lt $Cutoff) -and (pwdLastSet -ne "0") -and (EmailAddress -like "*")} -Properties DisplayName,EmailAddress,SamAccountName,distinguishedName | Set-ADUser -ChangePasswordAtLogon $true

Select all Open in new window

You would take care of the password complexity with your password policy set in Group Policy. Details on this page:
http://technet.microsoft.com/en-us/library/cc875814.aspx

Details on the filter for the Get-ADUser can be found on this page:
http://technet.microsoft.com/en-us/library/ee617241.aspx

Rory

Exactly and the distinguishedName that is returned includes the OU.

Glad to have helped.