1

Active Directory has a setting that forces a user to change his password upon his next login--visible in the AD Users and Computers applet, when right-clicking a user, selecting Properties, then Account...the very first checkbox in the "Account options" list is labeled "User must change password at next login".

This is not quite what I'm after. I've been tasked to find a way to make sure new AD users are forced to change their password during their first login (as in, the very first time they log in, ever). Is there such a policy? Ideally, I need something that works with Server 2003 domains and above.

Actually, that's not the full story...assuming such a policy exists, what I need to do is write a script that verifies that this is how the policy has been configured (that is, confirm that all new users will have to go through the process of getting their passwords changed).

  • The tickbox is automatically unticked after the first login. All you have to do is tick it after you create the user. As for verifying that this works, the only thing it involves is actually doing it. – gparent Mar 9 '15 at 18:10
  • 1
    gparent, that's exactly the problem with the existing approach; an admin might create a new user account, but untick the checkmark for one reason or another. In an environment that's going to be scrutinized and audited by a third-party, I need to be able to show / make the assertion that this can never happen. Not sure if that distinction makes sense...? – user77560 Mar 9 '15 at 18:20
  • Then you need to prevent administrators from creating users directly and instead give them access to an API that does not allow them to do that. – gparent Mar 9 '15 at 18:21
  • 2
    You do, since you're creating the account. – gparent Mar 9 '15 at 18:31
  • 1
    You can use the script here: techrepublic.com/blog/data-center/… to basically report on user accounts. But even if you added logic to pull the creation date of the user you'd need it down to the minute for both results to compare properly if you create the account in the morning and they change their password that day. I agree with Gparent and Hopeless though....and when you create a user just leave the checkmark checked. Simple IT policy. If your IT admins can't follow it...get new ones. – TheCleaner Mar 9 '15 at 18:46
0

What is being asked here is for a technical security control where currently only an administrative security control exists - a technical enforcement of the existing policy in place that tells admins the change password at next logon box must be checked when creating new users.

The way to do this is with a custom password filter DLL for AD. A password filter is notified when there has been a change to a user password and can take any action required from there. Usually this is used for password sync applications (eg. Syncing AD passwords to Google Apps).

In this case the action would be something like detecting the age of the user account, if less than X minutes then check the change password flag on the user account, if not set then set the flag on the account, therefore removing the admins' ability to not set this flag, intentionally or otherwise.

Custom password filters are described on MSDN, and there is an existing DLL called Password Hook that already does the hard part of what you need - detect a password change and start a program / script specified in a registry key.

| improve this answer | |
  • Interesting stuff, jotap. Unfortunately I don't have the luxury of being able to install any binaries on any system; the best I'm allowed to do essentially is get in, run a script, get out. I'll be discussing the feasibility with The Powers That Be. Thanks. – user77560 Mar 10 '15 at 12:39
0

JDS: This is the script I ended up with. You can google some of the magic numbers - I forget the details. Even though it's PowerShell, it should be pretty easy to translate to something else. (Pardon the formatting, something's having problems with it):

function Get-PwdLastSetValuesOfNeverLoggedInButEnabledAccounts() { $root = [ADSI]""

# Search criteria:  Enabled accounts that have never logged in
$search = [ADSISearcher]$root            
$search.Filter = "(&(objectclass=user)(objectcategory=user)" + `
    "(!(useraccountcontrol:1.2.840.113556.1.4.803:=2))" + `
    "(logoncount:=0)" + `
    ")"
$search.SizeLimit = 1500

$dictionary = New-Object 'System.Collections.Generic.Dictionary[System.String, System.Int64]'
try
{
    $results = $search.FindAll()
}
catch [System.Exception]
{
    # Ignore (allow) "The specified domain either does not exist or could not be contacted"
    # (the machine is not on a domain at all)
    if ( $_.Exception.HResult -ne 0x8007054B )
    {
        $dictionary.Add( "ExceptionWasThrown", -1 )
    }
    return $dictionary
}

foreach ( $result in $results )
{
    Write-Host "User $($result.Properties[ "name" ]):  $($result.Properties[ "pwdlastset" ][ 0 ])"
    if ( $result.Properties[ "pwdlastset" ] -ne 0 )
    {
        # Ignore admin accounts ending with "$"
        if ( $result.Properties[ "name" ][ 0 ].EndsWith( "$" ) ) { continue; }

        $dictionary.Add( $result.Properties[ "name" ], $result.Properties[ "pwdlastset" ][ 0 ] )
    }
}

return $dictionary

}

$dictionary = Get-PwdLastSetValuesOfNeverLoggedInButEnabledAccounts

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.