I have been asked to put the following one-time password scenario in place for our (small) Active Directory domain: whenever an administrator has to manually reset a user's password, the password should only be temporary, i.e. the user has to change it at logon, and its validity should be of 24 hours only. If the user does not log in and change his/her password within 24 hours, the account should be automatically deactivated.

I have looked into various ways to do this, including using a scheduled Powershell script, but I can't seem to find anything that would enable this scenario.

Is this possible at all in AD? If yes, how can I implement it?

  • ^You can force a user to change password on logon. The 24 hour limit must be done via a powershell task for example. – Daniel Jan 6 '17 at 14:44
  • @Daniel - Actually I need an answer for the 24 hour limit check, I know how to set the "User must change password at next logon" flag. – Under Vhoorl's Shadow Jan 6 '17 at 15:15

You would need to check the replication attribute metadata for the modification datetime on pwdLastSet for accounts with pwdLastSet == 0.

The LastOriginatingChangeTime of the pwdLastSet replication attribute metadata may be used to calculate how long ago it was set to "User must change password at next logon".

Get-ADReplicationAttributeMetadata -Object "CN=JSmith,OU=Users,OU=HQ,DC=contoso,DC=com" -Server CONTOSOMDDC1

AttributeName                                    : pwdLastSet
AttributeValue                                   : 0
FirstOriginatingCreateTime                       :
IsLinkValue                                      : False
LastOriginatingChangeDirectoryServerIdentity     : CN=NTDS Settings,CN=CONTOSOMDDC1,CN=Servers,CN=CONTOSO-MDSite,CN=Sit
LastOriginatingChangeDirectoryServerInvocationId : 4b6342cb-0853-493b-8485-991d9768fba3
LastOriginatingChangeTime                        : 2017-01-06 9:47:30 AM
LastOriginatingChangeUsn                         : 3256879
LastOriginatingDeleteTime                        :
LocalChangeUsn                                   : 3256879
Object                                           : CN=JSmith,OU=Users,OU=HQ,DC=contoso,DC=com
Server                                           : CONTOSOMDDC1.contoso.com
Version                                          : 5


If using a downlevel operating system, repadmin may be used:

repadmin /showobjmeta CONTOSOMDDC1 "CN=JSmith,OU=Users,OU=HQ,DC=contoso,DC=com" | findstr /i pwdLastSet  

3256879               CONTOSO-MDSite\CONTOSOMDDC1   3256879 2017-01-06 09:47:30    5 pwdLastSet
| improve this answer | |
  • It looks like Get-ADReplicationAttributeMetadata doesn't work on my setup (Windows Server 2008 R2 with Powershell 2). Does the cmdlet just Powershell 4, which is easy to upgrade, or would it also require an OS/AD upgrade? – Under Vhoorl's Shadow Jan 6 '17 at 15:22
  • If there aren't any modern operating systems available, repadmin /showobjmeta may be used. I updated the answer. – Greg Askew Jan 6 '17 at 16:05
  • It works with repadmin /showobjmeta thanks. I will try to use that in my Powershell script. – Under Vhoorl's Shadow Jan 6 '17 at 16:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.