Resetting AD user account passwords - Nightly

[maxrebo]

Hi,

We would like to reset the passwords (or disable the accounts) to our Supply staff AD accounts, nightly. What's the best tool to use to achieve this please?

[Steve21]

Search on Edugeek for Password235

 

I’ve posted a script previously that we used to use but can’t search easily on phone currently

 

Steve

[LeMarchand]

If you just want to disable, you could use logon hours.

 

[MisterTechMan]

We adopt a similar process for our Exam Accounts, we just use a batch file and scheduled task to disable them each night (or however often you need)

[maxrebo]

We adopt a similar process for our Exam Accounts, we just use a batch file and scheduled task to disable them each night (or however often you need)

 

Would you be able to share your batch file with me ?

[clareq]

We use powershell in a scheduled task:

 

Enable accounts:

Get-ADUser -Filter 'Name -like "*"' -SearchBase " | Enable-ADAccount

 

Disable accounts

Get-ADUser -Filter 'Name -like "*"' -SearchBase " | Disable-ADAccount

[jthompson]

We use PowerShell, too. This is the script we use when needing to schedule the enabling and disabling of exam accounts.

 

<#
.DESCRIPTION
   Script to enable or disable a list of users.
   Intended as a way to automate the scheduled availablility of exam accounts for specific lessons only.
.PARAMETER Action
   Controls whether accounts are being enabled or disabled.
.PARAMETER InputFile
   The path to a CSV file containing a list of usernames.
   The CSV file must include a column named 'Username'.
.EXAMPLE
   AccountsEnablement.ps1 -Action Disable -InputFile users.csv
   Will read the list of usernames from a csv file and disable each in Active Directory.
.EXAMPLE
   AccountsEnablement.ps1 -Action Enable -InputFile users.csv
   Will read the list of usernames from a csv file and enable each in Active Directory.
#>
[CmdletBinding()]
param(
   [Parameter(Mandatory)]
   [ValidateSet('Enable','Disable')]
   [string] $Action,
   [Parameter(Mandatory)]
   [string] $InputFile
)

# CSV file provided by command line argument.
# Load CSV file. Single field will need to be 'Username'.
$Users = Import-CSV $InputFile

if ($Action -eq 'Enable') {
   # Enable the user accounts.
   $Users | ForEach-Object {Enable-ADAccount -Identity $_.Username}
}

if ($Action -eq 'Disable') {
   # Disable the user accounts.
   $Users | ForEach-Object {Disable-ADAccount -Identity $_.Username}
}

 

Scheduling a PowerShell script can be abit more fiddly than a batch file. For this one, a Windows scheduled task would need to be as per this example.

 

Command:

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

 

Argumuments:

-Command "& 'C:\Path\To\script.ps1' -Action Enable -InputFile 'C:\Path\To\users.csv'"

 

The task then needs to be run as a user with suitable privileges in AD.

[Oaktech]

Scheduled Powershell task...

 

Assumes Office365 mail and on premises AD.

 

### Generates a request via the DinoPass API for a random simple password
$Password_Part1 = Invoke-WebRequest -Uri https://www.dinopass.com/password/simple | Select-Object -ExpandProperty content
### Generates a date in day-2digitmonth-4digityear
$Password_Part2 = Get-Date -format "dd-MM-yyyy"
### Concatenates the 2 into one variable
$Password_Complete ="$Password_Part1$Password_Part2"
### Writes the output to text file so you have a local reference - can be omitted.
$Password_Complete | Out-File C:\YourFileLocation\value.txt
### Resets the specified account password to the value contained within $Password_Complete
Set-ADAccountPassword -Identity UserName -Reset -NewPassword (ConvertTo-SecureString -AsPlainText "$Password_Complete" -Force)
### Emails the new password
### Email address to send from 
$username = "[email protected]"
### Email Password
$Password = "ComplexEmailPassword"
### Converts plaintext password above to a secure string
$Password = ConvertTo-SecureString -String $Password -AsPlainText -Force
### Creates a credential object to call later
$cred = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $username, $Password
### Specifies email subject
$subject = 'Alert: New Password'
### Specifies Email body
$body = $Password_Complete

### Splatting with Hash Table

$hash = @{

To = '[email protected]'
From = $username
Subject = $subject
Body = $body
BodyAsHtml = $true
SmtpServer = 'smtp.office365.com'
UseSSL = $true
Credential = $cred
Port = 587

}

### Sends Mail
Send-MailMessage  @hash -WarningAction Ignore

Edited May 24, 2023 by Oaktech

[enjay]

Scheduled Powershell task...

 

Assumes Office365 mail and on premises AD.

 

I've just posted a new thread about this, and someone sign-posted me here. Thanks - your script does exactly what I want it to.

[mavhc]

Scheduled Powershell task...

 

How do they get their password changed email if the password was changed?

[enjay]

How do they get their password changed email if the password was changed?

 

It is an account for agency cover staff who are only here for a day, so the password is emailed to the Cover Manager.

[dapaulio]

Personally I don’t agree with the automation of resetting passwords and emailing them. I get the reason why but this is compromising security for convenience. Only takes the cover manager account to be compromised and you have x number accounts exposed. I better idea would be to have a running document that you and her have access to that for refererence. But still even that poses a risk if CM account is compromised

 

I like the feature of automating disabling cover shared accounts daily.

 

I deploy a bank of cover accounts to the cover manager. It’s her responsibility to manage the account distribution and to have these enabled with ICT in time. Your cover teachers to begin should have no access to school data, USB should be disabled and cover staff encouraged to use one drive / google drive if they need one and they get Access to a RO share for the teacher who is covered to upload their lesson notes to.

[dgsmith]

Only takes the cover manager account to be compromised and you have x number accounts exposed.

 

To be fair, we'd have much more to worry about if the cover manager's, or any staff accounts, were compromised, than someone getting access to a handful of locked-down supply accounts for a day. If there is unauthorised access to a staff account where the supply passwords are emailed, that is presenting a much more serious concern, and would afford access to any data that accounts can access.

[enjay]

To be fair, we'd have much more to worry about if the cover manager's, or any staff accounts, were compromised, than someone getting access to a handful of locked-down supply accounts for a day. If there is unauthorised access to a staff account where the supply passwords are emailed, that is presenting a much more serious concern, and would afford access to any data that accounts can access.

 

100% agree. If the Cover Manager's account were compromised, I'd be much more concerned about access to MIS, HR and payroll data than I would about the agency teacher login. Also, the Cover Manager can see everything which the agency account can anyway!