Aging passwords

[padraic]

hi,

I need a way to automatically age a users password in
Active Directory.

If our passwords are set to expire after 30 days, is there
any way to set a password so that it has about three days
left? This will allow us to test a notification we're
setting up without having to wait the 30 days.

It is not feasible for us to change the Domain password
expiry limit just to test.

Any ideas are much appreciated.

 

[David Brandt [MSFT]]

Although somebody have have something that will do that, I'm not aware of a
utility/script/etc that will do it. You could install another dc to use for
testing (good desktop would do) then take it off line into a lab for
testing. Once in the lab, you'd need to seize the fsmo roles to it and do a
metadata cleanup on it in the production domain to get rid of it. When you
had it there, you could just move the dc's date/time up to whatever you want
to test the pw days thing. Of course when your testing was finished, you
would Not bring that box back into the domain in its current state, and
would either demote as last dc in domain or re-install.

255504 Using Ntdsutil.exe to Seize or Transfer FSMO Roles to a Domain
Controller
http://support.microsoft.com/?id=255504

216498 HOW TO: Remove Data in Active Directory After an Unsuccessful Domain
http://support.microsoft.com/?id=216498

--
David Brandt
Microsoft Corporation

This posting is provided "AS IS" with no warranties, and confers no rights.
Please do not send e-mail directly to this alias. This alias is for
newsgroup purposes only.

 

[Joe Richards [MVP]]

You can not write anything but 0 or -1 to the pwdLastSet attribute which is
where this info is stored. I.E. No you can not (without hacking) set an
arbitrary pwdLastSet value.

 

[Guest]

thanks! This was the answer I was trying to avoid!

just means slightly longer testing time.