Force user to change AD password at logon before Explorer loads?

Question

Background:

In our environment, users log onto a Windows 7 PC and then launch a full-screen Citrix XenApp (same as Microsoft RDSH) desktop. Citrix Reciever with single-sign on is used to launch the XenApp desktop. All work is done within the XenApp desktop. The XenApp servers are not necessarily in the same AD site as the Windows 7 machines.

We enforce password expiry every 30 days. Windows 7 and above prompt the user to reset their password via a balloon message in the notification area. This causes us two problems as detailed below:

Problems

1) Users change their password on their Windows 7 machine whilst already logged into Citrix XenApp, for example by pressing C+A+D. The XenApp desktop session is still authenticated using their old password. They then get problems within XenApp as obviously they cannot authenticate with IIS servers, SQL Servers etc.

2) Users change their password within their XenApp session. This means that their Windows 7 machine is still authenticated using their old password. They can fix this by locking the screen and unlocking it with their new password, however unfortunately this breaks the Single Sign On process of the Citrix client, so if they need to relaunch Citrix XenApp for any reason they cannot, unless they log off Windows 7 and then back on (this guy has the same problem http://discussions.citrix.com/topic/333487-published-desktop-with-receiver-password-changing/).

The crux of the problem is that users are able to change their password once the shell has already loaded. We did not have this problem when the end-user machines ran Windows XP. I think this was because Windows XP prompted the user to change password immediately after logon, before explorer.exe launched.

Question(s):

• Can we configure Windows 7 to prompt the user to change their password prior to the shell loading?
• If not, is there a third-party piece of software that can help us with this? Presumably any organisation that uses Windows 7 and above and also a RDSH/Citrix desktop will have a similar problem.

Answer 1

As a workaround, you can disable notifications for passwords which are going to expire soon; this way, the users will only be notified of expired passwords when they are actually expired, and will thus be forced to change them upon loggin on to their systems.

This can be configured via GPO: https://technet.microsoft.com/en-us/library/ee829687%28v=ws.10%29.aspx.

Answer 2

You could use the following PowerShell function to do this task. a desktop application wouldn't make much sense in my opinion

function ForcePasswordChange
{
    [CmdletBinding()]
    Param
    (
        [Parameter(Mandatory=$True)]
        [string]$ADGroup,
        [int]$Changes = "0"
    )
    Begin
    {
        Write-Warning "Script start for Group: $ADGroup"  
    }
    Process
    {
        Try
        {
            Get-ADUser -Filter * -SearchBase $ADGroup | ForEach {
                Set-ADUser -Identity $_.name -ChangePasswordAtNextLogon $true
                $Changes++
            }
        }
            Catch [System.Management.Automation.CommandNotFoundException]
            {
                Throw "Script has to run on a Domain Controller or on a Client with ActiveDirectory PowerShell Module installed. Script disrupted"
            }
            Catch [System.ArgumentException]
            {
                Throw "Could not resolve SearchBase (ADGroup) - ADGroup was $ADGroup. Script disrupted"
            }
            Catch [System.Management.Automation.ParameterBindingException]
            {
                Write-Error "Could not resolve Name Identity of one or multiple Users in ADGroup. Maybe ADGroup is empty. Script continues"
            }
    }
    End
    {
        Write-Warning "Script has finished. $Changes Users must change their Password on next logon"
    }
}

Just save this as ForcePasswordChange.ps1 and dot-source it to load the function into a powershell session on your domain controller

. C:\yourpath\ForcePasswordChange.ps1

Then you can Write it like this

ForcePasswordChange -ADGroup "OU=GroupName,OU=Users,DC=DomainPrefix,DC=Domain,DC=com"

Example for a group called "Powerusers" in OU "Users Europe" on domain internal.international.de

ForcePasswordChange -ADGroup "OU=Powerusers,OU=Users Europe,DC=internal,DC=international,DC=de"

You can also create a scheduled task who runs this script with the correct arguments every thirty days, then you don't need to do anything anymore.