up vote 4 down vote favorite
share [g+] share [fb]

When a user changes his password, it's typically sometime during the day. This means that a password expiration date set to last change + n days will result in the password expiring during the day. How can I force the passwords to expire at midnight of that day instead?

link|improve this question
6  
If they've ignored the Your password will expire in n days message for 2 weeks already so their password actually does expire in the middle of the day, what makes you think expiring the password at midnight will help :-) Seriously though, I don't think what you want will help, and personally I have no sympathy - if someone ignores a message every time they log on that warns them of impending doom for a whole 2 weeks, then it's their own fault really. – Ben Pilbrow Aug 12 '11 at 17:40
@Ben Agreed, but with Windows 7, the notification is a balloon pop-up near the system tray, instead of a modal dialog during logon. It is even easier to ignore now. sigh. – jscott Aug 12 '11 at 17:44
feedback

1 Answer

up vote 4 down vote

I don't believe that is possible without manually changing the PwdLastSetattribute within ADSI Edit, which I wouldn't recommend doing.

The value is stored in 100-nanosecond intervals since 12:00 am January 1, 1601. However, your only options to edit the attribute are to set it to 0 (password is now expired and user must reset), or -1 (value for PwdLastSet is changed to the current date/time).

As mentioned in comments, you would need to set the value to 0 first, then set it to -1.

You could potentially write a script to update the attribute to -1 at midnight on a given day for all users. However, this would set all your user's passwords to expire @ midnight in N days (N being your domain password policy max age setting). This could potentially extend the max age of a password.

What is your goal in setting the password to expire at midnight?

link|improve this answer
In my testing, with VBS and PowerShell, I need to first do a setInfo() to change pwdLastSet to 0 and then a second setInfo() to change it to -1. – jscott Aug 12 '11 at 17:46
It is not possible to manually edit the timestamp in pwdLastSet. The only thing you can mainpulate with it is a forced expiration of the password. – Brian Desmond Aug 12 '11 at 19:38
You can change it to 0 or -1 with ADSI Edit or by scripting as my answer states. I'll update my answer to be a little more clear. – Cheekaleak Aug 12 '11 at 19:59
The main goal is to be consistent with other systems that get the expiry info from LDAP, but don't have sub-day granularity. The secondary goal is for users to change their passwords at the start of the day instead of potentially getting interrupted in the middle of something. – anonymous Aug 12 '11 at 20:30
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.