Powershell Password date reset script please

[truebluesteve]

Hi

 

I am implementing a new password policy which will come into effect in October where all staff users will need to change their passwords. To do this I need to reset the pwdLastSet attribute in AD for each user and this needs to be done twice - the value needs to be set to 0 and saved and then to -1

 

I don't want to do this for the whole domain, just specific OU's

 

Can any of you PS gurus help me please!

 

Cheers

[halbaradkenafin]

I'm not sure how easy it is to set it to -1 but setting it to 0 is easy enough using Set-ADUser -ChangePasswordAtLogon $True. You can specify OUs quite easily:

 

Get-ADUser -Filter * -SearchBase "OU=Somewhere,OU=Somplace,DC=Domain,DC=Local" | Set-ADUser -ChangePasswordAtLogon $True

[truebluesteve]

Thanks... The 0 sets the password value to 'Never changed' and the -1 sets the password last change to today's date. Annoying thing is you have to set it to 0 first otherwise it reverts to the previous value

 

I don't want them to have to change their passwords today hence the need to use the pwdLastSet attribute

Edited June 26, 2015 by truebluesteve

[truebluesteve]

Did a bit of searching on the Interweb and found some help. Just tried it on a OU and it works a treat!

 

https://www.shellandco.net/set-the-pwdlastset-attribute-to-the-current-date-and-time/