History of user's password change dates

[edie209]

is there a way to get a users password change history?

 

We have a user accusing IT of changing their password outside of the agreed change times.

 

I can get the users last change using

 

[color=#660066][font=inherit]Import[/font][/color][color=#666600][font=inherit]-[/font][/color][color=#660066][font=inherit]Module[/font][/color][color=#000000][font=inherit] [/font][/color][color=#660066][font=inherit]ActiveDirectory
[/font][/color][color=#660066][font=inherit]Get[/font][/color][color=#666600][font=inherit]-[/font][/color][color=#660066][font=inherit]ADUser[/font][/color][color=#000000][font=inherit] [/font][/color][color=#008800][font=inherit]'user1'[/font][/color][color=#000000][font=inherit] [/font][/color][color=#666600][font=inherit]-[/font][/color][color=#000000][font=inherit]properties [/font][/color][color=#660066][font=inherit]PasswordLastSet[/font][/color][color=#000000][font=inherit] [/font][/color][color=#666600][font=inherit]|[/font][/color][color=#000000][font=inherit] [/font][/color][color=#660066][font=inherit]Format[/font][/color][color=#666600][font=inherit]-[/font][/color][color=#660066][font=inherit]List[/font][/color]

 

But I want the last 10 change dates anyone ever achieved this?

[Steve21]

If you got auditing turned on in the DC it'd log it in event viewer etc, else don't think so without additional tools/scripts for the future.

 

Not really sure what it'd prove though as anyone who knows their password could change it multiple times So said user could just change it 10 times and go oi look its you still

 

Steve

[Domino]

I don't *think* AD stores the history on that, but I could be wrong.

 

If you're doing security log collection on the DCs you should be able to filter the historical log for the password change notifications?

[Domino]

 

Not really sure what it'd prove though as anyone who knows their password could change it multiple times So said user could just change it 10 times and go oi look its you still

 

Depending on the minimum password age in the password policy...

[dapaulio]

is there a way to get a users password change history?

 

We have a user accusing IT of changing their password outside of the agreed change times.

 

I can get the users last change using

 

[color=#660066][font=inherit]Import[/font][/color][color=#666600][font=inherit]-[/font][/color][color=#660066][font=inherit]Module[/font][/color][color=#000000][font=inherit] [/font][/color][color=#660066][font=inherit]ActiveDirectory
[/font][/color][color=#660066][font=inherit]Get[/font][/color][color=#666600][font=inherit]-[/font][/color][color=#660066][font=inherit]ADUser[/font][/color][color=#000000][font=inherit] [/font][/color][color=#008800][font=inherit]'user1'[/font][/color][color=#000000][font=inherit] [/font][/color][color=#666600][font=inherit]-[/font][/color][color=#000000][font=inherit]properties [/font][/color][color=#660066][font=inherit]PasswordLastSet[/font][/color][color=#000000][font=inherit] [/font][/color][color=#666600][font=inherit]|[/font][/color][color=#000000][font=inherit] [/font][/color][color=#660066][font=inherit]Format[/font][/color][color=#666600][font=inherit]-[/font][/color][color=#660066][font=inherit]List[/font][/color]

 

But I want the last 10 change dates anyone ever achieved this?

 

That is just ridiculous. As if we have time or want to change a user passwords more than we have too. There is no personal benefit from it. I wouldn't justify them with a response.

 

I wrote a ps script which emails user and cc the it support mailbox a reminder that their password is due to expire within 7 days. This wont help you now but you will be able to start a log. Im off work atm but Let me know if you want to post my script and I'll grab it for you

Edited February 18, 2016 by dapaulio

[Nixon77]

IT can change a password when ever they deem necessary. All users should be aware.

[edie209]

 

I wrote a ps script which emails user and cc the it support mailbox a reminder that their password is due to expire within 7 days. This wont help you now but you will be able to start a log. Im off work atm but Let me know if you want to post my script and I'll grab it for you

 

 

That would be be great thank you

[CyberDrac]

I recently saw a product called Netwrix Auditor that suggested that tracking AD changes including passwords might be possible, but I don't know how expensive it was, it was price on application. I also never worked out whether it was able to work with historical data and well as data post installation. They do a trial, but I never got around to doing anything with it.

[edie209]

Thanks I have just downloaded it and I will have a look and see if it can do what is required

[dapaulio]

Here is the script i referred to before. It has only been tested on an onsite exchange 2010. i would advise testing the script if you have any other configuration. i realised this is a script that adapted off the internet so i cannot claim credit as i did in my first post

 

https://www.dropbox.com/s/jw3891sne6e4yr9/PasswordNotification.rar?dl=0

 

if you havent done it already you will need to set the execution policy to bypass or have the script signed.

set-executionpolicy bypass or remotesigned. google it if you need help on this feature

 

1 - Extract folder onto your exchange server or a server that has access to your exchange powersehell commands

2 - modify the variables in PasswordChangeNotification.ps1

3 - Modify the [email protected] which is at the bottom of the script (i dont know why i didnt set this as a variable in the first place)

4 - Modify PasswordNotify.cmd making sure the location of PS shell and the location of the PasswordChangeNotification.ps1 are correct. this script calls the ps1 script

5 - once you are satisfied it is working, create a schedule task to run the cmd script (rather than the ps1 script). i created a trigger of monday and friday morning

6 - Personally i would create a schedule task user that has permission to run tasks on the server but for testing you could authenticate using your own domain admin account

[edie209]

I will look into this thanks, we have O365 so there may be some differences we will see