Supply accounts

[dgsmith]

For a number of years, we had a single supply account with a static password. Obviously we have had to move away from that approach, but our current approach isn't alot better, which involves us having 5 separate accounts, with a password we change each day (to a set format, involving the date).

 

Unfortunately, this means we have to remember to change it, and keep the format the same, as the cover manager wants to get the booklets printed before we arrive onsite.

 

I am thinking about whether there is an easy way to script this, so something could be run from the command line or a utility to change the passwords to something random; I am even thinking whether the cover manager can run this themself, and generate new passwords just for the supply accounts. In an ideal scenario, she would have a program with a "reset all" button, and a list of the new passwords generated against those accounts, but i'd have to look at what AD permissions she'd need, to ensure it's not elevated beyond what's necessary, but this is just a thought.

 

Just wondering what others do about it? Our current setup is not ideal at all, but we can't really think of something else that will easily work without having to be a burden on someone's time each day, and something which allows the cover manager to manage it autonomously is what we really need to be aiming for.

[Steve21]

We have a script on the DC that once a week (but you could do daily etc) resets all the supply accounts to a password and emails it to our HR/cover officers who then write it on the front of the cover book etc

 

Steve

[Zourous]

We still have a single account with a static password but the account can only be used on PC's in the staff OU and that seems to work for us.

[dgsmith]

We have a script on the DC that once a week (but you could do daily etc) resets all the supply accounts to a password and emails it to our HR/cover officers who then write it on the front of the cover book etc

 

Steve

 

Is this something you could share?

 

We still have a single account with a static password but the account can only be used on PC's in the staff OU and that seems to work for us.

 

Due to classrooms here being used as lunchrooms, we couldn't take that risk. Also if a teacher is off, their room may not get locked..

[Steve21]

We have two sets of cover depending on how they're assigned, so just add/take out the lines as to whether you want their passwords force changed at logon.

 

And a shortened password list, (Just used a random generator to make whole lot of them but would spam the post a bit

 

$RanPaswd= Get-Random -InputObject "Password235", "Password244", "Password069", "Password155"


$SecPaswd= $RanPaswd | ConvertTo-SecureString –AsPlainText –Force
Set-ADAccountPassword -Reset -NewPassword $SecPaswd –Identity Cover01
Set-ADAccountPassword -Reset -NewPassword $SecPaswd –Identity Cover02
Set-ADAccountPassword -Reset -NewPassword $SecPaswd –Identity Cover03
Set-ADAccountPassword -Reset -NewPassword $SecPaswd –Identity Cover04
Set-ADAccountPassword -Reset -NewPassword $SecPaswd –Identity Cover05

Set-ADAccountPassword -Reset -NewPassword $SecPaswd –Identity Cover06
Set-ADUser -Identity Cover06 -ChangePasswordAtLogon $true

Set-ADAccountPassword -Reset -NewPassword $SecPaswd –Identity Cover07
Set-ADUser -Identity Cover07 -ChangePasswordAtLogon $true

Set-ADAccountPassword -Reset -NewPassword $SecPaswd –Identity Cover08
Set-ADUser -Identity Cover08 -ChangePasswordAtLogon $true

Set-ADAccountPassword -Reset -NewPassword $SecPaswd –Identity Cover09
Set-ADUser -Identity Cover09 -ChangePasswordAtLogon $true

Set-ADAccountPassword -Reset -NewPassword $SecPaswd –Identity Cover10
Set-ADUser -Identity Cover10 -ChangePasswordAtLogon $true

$notificationto = "[email protected]" 
$notificationfrom = "[email protected]" 
$smtpserver = "10.111.111.111" 
Send-MailMessage -Body $RanPaswd -to $notificationto -from $notificationfrom -Subject "Supply Staff Weekly Password" -SmtpServer $smtpServer 

 

Steve

[dgsmith]

That's great Steve! Admittedly I had to rework the email code as it wouldn't send without credentials (and there are special parameters for passing those details too!) but I have the same thing working here now, and the cover manager is alot happier

 

The only other change I made to your code was the random generator you referred to (which you may or may not have on your one): $RanPaswd1= Get-Random -Minimum 10000 -Maximum 99999 (in order that it is entirely random, and not one of various static different passwords) and then concatenated it to a string in the SecPaswd line). Also I set a different variable for each of our accounts, but it's definitely been a big help in automating our setup. Annoyed we didn't do something like this a long time ago really.

[Steve21]

Ah yeah the relay we use doesn't auth against our server IPs so never bothered with that part haha.

 

Glad to hear it helped though, Certainly makes life a lot easier than doing it manually

 

Steve

[markwilfan]

Nice one guys. Shame you can't do this with sims passwords too

[dgsmith]

In case anyone else is interested, I modified Steve's code to the following, to generate random numbers in a loop then assign. Our username format for supply is A1, A2 etc and our password format is now a1-#####, a2-##### etc.

 

For ($i=1; $i -le 5; $i++) {
   $RanPaswd= Get-Random -Minimum 10000 -Maximum 99999
   $SecPaswd = "a$i-$RanPaswd" | ConvertTo-SecureString –AsPlainText –Force
   $username = -join ('a',$i)
   New-Variable -Name "spassword$i" -Value $RanPaswd
   Set-ADAccountPassword -Reset -NewPassword $SecPaswd –Identity $username
}

$spassword1, $spassword2 etc holds the specific account password numbers in variables which I concatenate in the email body. We just need to think about how we deal now with SIMS..

[markwilfan]

Would be nice if the next version of sims there was an api which we could use to do these kinds of things

[Steve21]

We are gonna trial this soon at ours.

 

Basic script to change it, force them to set own password, then use trusted login to sims linked to a supply.

 

So the password for sims is effectively daily changed and even if someone finds out the original login it'll be changed at first lesson by the supply etc

 

Each supply account then has its unique linked sims account

 

Steve