3

Background: we have had a very relaxed AD password policy for years. Users have had 'password never expires' set and we were not enforcing strength or anything. We now want to rectify that and have turned on the strong password requirements in AD, and set passwords to expire after 180 days.

Side note of importance, our e-mail system is Zimbra which authenticates to AD via LDAP

Problem: I cannot figure out a way to force users to change their password but let them continue to use their current password for a week or two until they can all login to a domain computer. ANything I try has the affect of locking out the users as soon as I do it. So say a manager is at a conference this week and won't be back til next week. His stops getting email on his phone as soon as I try to implement the policy until he comes back to the office and logs in again

Solutions attempted:

  1. Turn off password never expires, turn on 'user must change password at next logon.' Result is current password treated as expired and AD refuses to auth user via ldap (no e-mail for that user)

  2. Try to fool it by turning off 'password never expires', setting pwdLastSet to -1 which makes their last password change today, then setting 'user must change password at next logon'. Result: pwdLastSet is set back to 0 [never] and password is considered expired and won't authenticate users

Is there any way to accomplish what i'm trying to do?

4 Answers 4

1

What are your Domain and Forest Functional Levels? Fine-grained password policies sound like they could be your friend here.

You could use them use them to exclude the users you need to exclude from having password policies kick in until you're ready, and/or set up PowerShell scripts to [effectively] apply these polices to users on a schedule.

2
  • the problem is i don't know who those users are until they call me angrily from the airport because their email is not working. i can always then go in and flip the password to never expire and tell them to call me when they get back but i was strying to avoid the angry call to begin with.
    – Brian Dial
    Jan 14, 2015 at 21:38
  • @BrianDial Well, that's purely a Layer 8 issue. You need to communicate properly ahead of time, like others have said, and be willing and able to stand up to jackass morons who think II is magic, or IT people should be mind readers. The standing up part generally requires management support or an extremely high level of job security and/or apathy. If you work somewhere worth working, though, you shouldn't be expected to take abuse for implementing IT security policies. Jan 14, 2015 at 21:59
0

How about just communicating the policy change with a decent notification email, defining a reasonable grace period? Notify a couple of times, including on the last day of the grace period. You should be able to pick up most people, based on this

If you must enforce it, after the grace period, run a one-time script against all users that have a 'password last set' date before the first notification, either to disable them or force the 'user must change at next logon' flag.

Otherwise, can you not just update all the 'password never expires' fields without checking the 'must change at next logon', and use the pwdLastSet = -1 trick to reset the date at the start of the grace period?

0

I would send an email to users that haven't changed their password within the threshold and tell them to change their password by a specified date, after which Password Never Expires will be turned off. When that date arrives, remove Password Never Expires for users that have changed their password. Repeat until finished.

1
  • yeah i probably shoudl've done that from the beginning, and its probably the best solution now. I was just trying to avoid a 2nd mass email as i already sent one saying "dont change your password on your own, wait for it to prompt you". I have been thinking of ways using PSOs as others have suggested here but ultimately I think this route is the least complicated in the long run. thanks everyone!
    – Brian Dial
    Jan 14, 2015 at 21:53
0

As I understand it, you're looking for a way to create a time window that would force only users logging to a computer, but not a phone.
I don't think it's possible, but I have several thoughts:

  1. Create several Password-Policy-Objects (PSO) and apply them to the different users according to their needs.
  2. In all PSOs set the notification so users will receive an early enough warning about password expiration (maybe even send an email), so they'll remember to change them while in the office.

Creating a PSO is possible only in domain level 2008, so if that's not you domain level just do these settings in the main policy (in the GPO).

How to create a PSO:
http://technet.microsoft.com/en-us/library/cc754461.aspx
http://kpytko.pl/active-directory-domain-services/fine-grained-password-policy-in-windows-server-20082008r2/

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .