Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

When a user changes his password, it's typically sometime during the day. This means that a password expiration date set to last change + n days will result in the password expiring during the day. How can I force the passwords to expire at midnight of that day instead?

share|improve this question
8  
If they've ignored the Your password will expire in n days message for 2 weeks already so their password actually does expire in the middle of the day, what makes you think expiring the password at midnight will help :-) Seriously though, I don't think what you want will help, and personally I have no sympathy - if someone ignores a message every time they log on that warns them of impending doom for a whole 2 weeks, then it's their own fault really. –  Ben Pilbrow Aug 12 '11 at 17:40
1  
@Ben Agreed, but with Windows 7, the notification is a balloon pop-up near the system tray, instead of a modal dialog during logon. It is even easier to ignore now. sigh. –  jscott Aug 12 '11 at 17:44

2 Answers 2

I don't believe that is possible without manually changing the PwdLastSetattribute within ADSI Edit, which I wouldn't recommend doing.

The value is stored in 100-nanosecond intervals since 12:00 am January 1, 1601. However, your only options to edit the attribute are to set it to 0 (password is now expired and user must reset), or -1 (value for PwdLastSet is changed to the current date/time).

As mentioned in comments, you would need to set the value to 0 first, then set it to -1.

You could potentially write a script to update the attribute to -1 at midnight on a given day for all users. However, this would set all your user's passwords to expire @ midnight in N days (N being your domain password policy max age setting). This could potentially extend the max age of a password.

What is your goal in setting the password to expire at midnight?

share|improve this answer
    
In my testing, with VBS and PowerShell, I need to first do a setInfo() to change pwdLastSet to 0 and then a second setInfo() to change it to -1. –  jscott Aug 12 '11 at 17:46
    
It is not possible to manually edit the timestamp in pwdLastSet. The only thing you can mainpulate with it is a forced expiration of the password. –  Brian Desmond Aug 12 '11 at 19:38
    
You can change it to 0 or -1 with ADSI Edit or by scripting as my answer states. I'll update my answer to be a little more clear. –  Cheekaleak Aug 12 '11 at 19:59
    
The main goal is to be consistent with other systems that get the expiry info from LDAP, but don't have sub-day granularity. The secondary goal is for users to change their passwords at the start of the day instead of potentially getting interrupted in the middle of something. –  anonymous Aug 12 '11 at 20:30

Windows simply doesn't support the concept of a "password expiry time" that applies globally. You also cannot set the time, except to say it is expired now, or that it was just changed. However, what you could do is write a script using command-line AD tools or powershell that runs nightly: it can query AD for users with passwords due to expire in less than 24h (pwdLastSet is older than one day less than your password max age days), and set it to -1 (the password is expired). This would avoid extending password life unintentionally, and also avoid midday password expiration.

There are also third-party tools that can do this kind of thing for you. For instance, one feature of Hitachi ID Password Manager allows you to pop up a web browser in which the user must change their password or else be logged out, and you can set this to happen an arbitrary number of days in advance of the actual expiration.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.