Active Directory New password policy - should I wait?

Question

I am going to enforce a new password policy on our domain.

The main issue I have is should I wait for the max time to pass for the user to change his current password, or to enforce the: change at next logon?

I have many users, and to go one by one setting the change can take half a day. but to wait for the max time, can take 91 days (as set).

I thought to set the max time to 5 days (e.g.) and on the 4th day to change that again to the 91 I want, but I am not sure how to know if all the users changed the password in that time.

Ideas?

Answer 1

Have you communicated the new password policy to your users?

If you know for sure that everybody knows there will be a new policy and that they're going to have to change their passwords, then there should be no problems with enforcing a change at next logon.

However, if you haven't given your users enough notice, then many of them will be caught unawares when they're forced to change their password at next logon, and you'll be dealing with the following scenario a lot:

1. User logs in and sees that they must change their password.
2. User does not much care about password policy, but wants very much to check their email, and so selects a new password essentially at random.
3. User forgets this new password shortly thereafter, cannot log in anymore, and asks you for help with a reset.

As for knowing whether a user has changed his/her password, Active Directory stores a pwdLastSet attribute for each user:

The date and time that the password for this account was last changed. This value is stored as a large integer that represents the number of 100 nanosecond intervals since January 1, 1601 (UTC). If this value is set to 0 and the User-Account-Control attribute does not contain the UF_DONT_EXPIRE_PASSWD flag, then the user must set the password at the next logon.

You could run a query against Active Directory to find the users for whom pwdLastSet was more than a couple of days ago, and then force only those users to reset their passwords.

Finally, to set the "Must change password at next logon" flag for multiple users at once, you can use dsmod:

dsmod user <user_dn> -mustchpwd {yes|no}

Make up a batch file with a dsmod command for every user whose pwdLastSet is too long ago, and voila! You have your password policy enforcement mechanism.

Answer 2

Set up your policy. Communicate the change to your users and let them know that on a particular day the new policy will come into force. The day before - remind them. Then use a script like this visual basic to force users to change the password at next logon.

Set objUser = GetObject _ 
    ("LDAP://CN=myerken,OU=management,DC=Fabrikam,DC=com") 

objUser.Put "pwdLastSet", 0 
objUser.SetInfo

Reference

Answer 3

This is extremely subjective. It comes down to possibly some of the following factors:

• Is there an event which is driving the change?
• How quickly can the organization typically disseminate information of this nature?
• How much disruption can this change cause with its implementation vs. non-implementation?
• How much support is available to support the change?

It's a combination of the organization, why the change is needed and how quickly can the change be communicated as well as implemented. It will vary greatly across each different organization as well as their specific situations.