Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Due to mistakes by the helpdesk staff, I found that over a 100 user accounts in my company AD have been set so that their passwords never expire. To avoid the situation in which all these users suddenly find themselves unable to log in, I want to run a script to set the password expiry to a specified date.

I'm using Quest AD cmdlets, but I've only used powershell for simple scripts to get lists of users. The attribute I'm trying to modify is 'PasswordStatus' and I want to set those with this attribute set as "password never expires' to a specific date. Not much of a scripting guy, so any help in this would be most welcome.

share|improve this question
add comment

1 Answer

up vote 3 down vote accepted

A better fix would be to set those 100 accounts to be required to change password on next login (thus not preventing them from logging in), and then a few days later, setting a password age policy (or fine-grained password policies, if you need more than one.)

The first step could be done pretty easily with a CSV input for dsquery, piped into dsmod; keeps it very simple.

The second step will prevent the helpdesk from making this mistake in the future, by taking that part of the process out of their hands.

share|improve this answer
    
Thanks mfinni. Don't know why I didn't think of that. Simple solutions are the best:) The only possible problem is that lots of users log in via VPN, which authenticates via AD. Not sure how requiring them to change their passwords will affect them logging on to the VPN. –  Pierre E Dec 5 '12 at 5:29
    
That will affect them, If you have OWA, you should be able to easily provide them a method to change their password. Depending on your VPN client, that can do it too. –  mfinni Dec 5 '12 at 13:44
    
Don't forget to mark an accepted answer, too! –  mfinni Dec 5 '12 at 13:46
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.