How to exprie ALL acct. passwords?

[Lamar Thomas]

We are running Windows 2003 Servers as our domain controllers and about 5000
users. What we want to do is expire EVERYONE'S network acct. and make them
change their passwords at the end of this week (Friday). Any ideas on an
easy way to do this?


Thanks in advance,


Clayton

 

[Tomasz Onyszko [MVP]]

We are running Windows 2003 Servers as our domain controllers and about 5000
users. What we want to do is expire EVERYONE'S network acct. and make them
change their passwords at the end of this week (Friday). Any ideas on an
easy way to do this?

You want to expire all passwords - not expire account? So just force
users to change the password? - It's easy with ADSI script, for each
account You should modify pwdLastSet and set it to 0:

http://www.rallenhome.com/books/adcookbook/src/06.21-must_change_passwd.vbs.txt

This will force users to change password at next logon.

 

[barry]

We are running Windows 2003 Servers as our domain controllers and about 5000
users. What we want to do is expire EVERYONE'S network acct. and make them
change their passwords at the end of this week (Friday). Any ideas on an
easy way to do this?


Thanks in advance,


Clayton

Think You can possibly do this with ADModify. Though I'm at home at the
mo, and can't remember oif the top of my head.

That just incase you can't be arsed to script. Though if you can't, I
suggest learning. It's the way forward

 

[Ulf B. Simon-Weidner [MVP]]

We are running Windows 2003 Servers as our domain controllers and about
5000
users. What we want to do is expire EVERYONE'S network acct. and make
them
change their passwords at the end of this week (Friday). Any ideas on an
easy way to do this?

Hello Lamar,

That's also pretty easy via the command line, the command should look
like

Dsquery user domainroot | dsmod user -mustchpwd yes

Please test that first, I can't test that right now - minor
modifications might be necessary. Also note that you might not want all
user accounts (like the administrator, serviceaccounts) so should
modify the scope of your search as necessary (e.g. to a MyCorpUsers-OU)
instead of using the domainroot.

--
Gruesse - Sincerely,

Ulf B. Simon-Weidner

MVP-Book "Windows XP - Die Expertentipps": http://tinyurl.com/44zcz
Weblog: http://msmvps.org/UlfBSimonWeidner
WebSite: http://www.windowsserverfaq.org

 

[Joe Richards [MVP]]

adfind -b dc=domain,dc=com -f samaccounttype=805306368 |admod pwdlastset::0

That will expire every userid's password that you have permission to expire.

If you want to focus on a specific OU, specify that in the base DN specified by -b

You can get adfind and admod from www.joeware.net

joe