User password expire

[2Tian]

In AD,
a) Is there anyways to see all AD users password when it expires?
b) Is there anyways to configure such that it will automatically send email
alert to user whose AD account going to expire in the next 10 days?

 

[myweb]

Hello 2Tian,

Expiring passwords

MS provides a lot of scripting possibilities: http://www.microsoft.com/technet/scriptcenter/resources/qanda/sept05/hey0902.mspx

Here are some free tool:
http://www.joeware.net/win/free/tools/findexpacc.htm

Alerting the user

In your Group policy go to:
Computer configuration>Windows settings>Security settings>Local policies>Security

options: Prompt user to change password before expiration, their you can
set the amount of days.


Best regards

myweb
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.

 

[Jorge de Almeida Pinto [MVP - DS]]

check out:
http://www.joeware.net/win/free/tools/findexpacc.htm

Summary

Command line Active Directory query tool to find expired accounts. This
will find accounts that are expired or accounts with expired passwords.
--

Cheers,
(HOPEFULLY THIS INFORMATION HELPS YOU!)


# Jorge de Almeida Pinto # MVP Windows Server - Directory Services

BLOG (WEB-BASED)--> http://blogs.dirteam.com/blogs/jorge/default.aspx
BLOG (RSS-FEEDS)--> http://blogs.dirteam.com/blogs/jorge/rss.aspx

 

[Richard Mueller [MVP]]

In AD,
a) Is there anyways to see all AD users password when it expires?
b) Is there anyways to configure such that it will automatically send email
alert to user whose AD account going to expire in the next 10 days?

I have a sample VBScript program that documents when all users in the domain
last changed their password:

http://www.rlmueller.net/PwdLastChanged.htm

Determining when a given user's password expires is a bit involved. I have a
sample program to determine this for one user linked here:

http://www.rlmueller.net/User Password Info.htm

 

[Joe Richards [MVP]]

Look at findexpacc, a couple of the posts have links plus you can always
google it.

There is nothing builtin that will send email alerts, however, enough
info should be returned by findexpacc to allow you to email folks, that
was the point behind when I wrote it.

--
Joe Richards Microsoft MVP Windows Server Directory Services
Author of O'Reilly Active Directory Third Edition
www.joeware.net


---O'Reilly Active Directory Third Edition now available---

http://www.joeware.net/win/ad3e.htm

 

[2Tian]

you meant i have to manually email to user whose AD accounts is expiring
soon? There are no other way to do it automatically? Not even Script?

 

[Joe Richards [MVP]]

No you can script it, you can script pretty much anything. What I am
saying is there is no native built in way that you just turn on.

Again findexpacc should give you enough info that your script could send
the right email to the right people.

--
Joe Richards Microsoft MVP Windows Server Directory Services
Author of O'Reilly Active Directory Third Edition
www.joeware.net


---O'Reilly Active Directory Third Edition now available---

http://www.joeware.net/win/ad3e.htm

 

[Kurt L]

Hi - The company I work for (I'm the lead of our support team and my background is in AD security and Exchange) has a super tool that does exactly this, does it easy + reliably, and is overall quite awesome.

Password Reminder PRO http://www.sysoptools.com
Allows you to:
Enforce a global domain password expiration policy for your users with lower support overhead
Easily alert users in advance of when their password is expiring, at multiple intervals
Designed to work with all types of domains and active directories
Designed to work with Exchange (but will work with any mail server)
Lower help desk calls from users and instances of users with expired accounts
Gives you complete reporting on your AD user accounts.
"Smart" reminders do not pam users or send reminders to obvious system, service and resource accounts.

This is a great tool that not only gives you ability to alert users of expiring passwords but also provides a very specific reporting console for review of AD user objects. no scripting, smtp or iis installation is required, and there is also an included "QA" mode which allows you to fully test it our in your environmnt without disturbing your users.
Fully automated and simple for any non-scripter to install / deploy / support.

While I openly do work for the company, as a long-time scripter and domain admin our tool is a drastic improvemnt above using a VB script, and the reminders sent to users are customizable to your environment.

Plus we offer a 60 day free full-featured version to try in your domain, and full tech support during your trial period.




EggHeadCafe.com - .NET Developer Portal of Choice
http://www.eggheadcafe.com

 

[Jorge de Almeida Pinto [MVP - DS]]

for folks who do not have the money for such a tool you can also use:
FindExpAcc.exe from joeware.net.
It is really inexpensive, better said: free! ;-)

--

Cheers,
(HOPEFULLY THIS INFORMATION HELPS YOU!)

# Jorge de Almeida Pinto # MVP Windows Server - Directory Services

BLOG (WEB-BASED)--> http://blogs.dirteam.com/blogs/jorge/default.aspx
BLOG (RSS-FEEDS)--> http://blogs.dirteam.com/blogs/jorge/rss.aspx