Hello Browolf,

Nice little script. Thought I would just throw in my thoughts:

I would not recommend using a wildcard filter (-filter *) or -properties * this is needlessly expensive as you are going to get every single AD user account then do a check against every single one in your If statement.

You could use:

get-aduser -filter 'useraccountcontrol -eq "544"' -properties useraccountcontrol. This will return only the accounts with that flag and only the extra properties you need (and samaccountname is a default one that is pulled back).

And to make it even safer you could also add -searchbase and point it to a specific OU.

Also just a side note for people that might panic thinking all their accounts have 544 and can be blank - this is not the case, they still follow any password policy enforced by Group Policy.

Here is my take on this, please note this is untested and continue at your own risk:

function Get-PasswordBlankAllowed { [CmdletBinding()] param ( [Parameter()] [switch] $outlog, [Parameter()] [switch] $fix ) write-host "Finding all accounts with 544 UserAccount Flag $(if ($fix){'and attempting to change the flag.'}) $(if ($fix){'Log located in C:\temp\544Flag.log.'})" get-aduser -filter 'useraccountcontrol -eq "544"' -properties samaccountname,useraccountcontrol | ForEach-Object { write-host "$($_.samaccountname) - $($_.useraccountcontrol)" if($fix) { write-host set-adaccountcontrol $_.samaccountname -PasswordNotRequired $false } if($outlog) { Add-Content -path C:\temp\544flag.log "$($_.samaccountname) $(if ($fix){', Fixed'})" -force } }}

Examples of use

Get-PasswordBlankAllowed #Just lists the usersGet-PasswordBlankAllowed -outlog #Lists the users and outputs a log to C:\temp\544flag.logGet-PasswordBlankAllowed -fix #Lists the users and alters their account Get-PasswordBlankAllowed -outlog -fix #Alters their account and creates the log

Thank you very much for the blog post, hope my take on it is something you like - I am a fan of seeing the other ways people achieve something.