Automatic Password Change

enjay · July 6, 2016

Does anyone know of a tool which can automatically change a particular user's AD password on a schedule, then email someone else with that password? I'm looking for a lazy/automated/can't-be-forgotten way of changing the guest teacher password on our network...

sparkeh · July 6, 2016

Scheduled powershell script could do this with a combination of these commands?

Set-ADAccountPassword: https://technet.microsoft.com/en-gb/library/ee617261.aspx

Send-MailMessage: https://technet.microsoft.com/en-us/library/hh849925.aspx

enjay · July 6, 2016

That script prompts for a password and waits for it to be entered, I'd like the script to choose the password itself and so be totally hands-off.

sparkeh · July 6, 2016

Mm but you could supply a randomly generated one as a variable.

In fact someone has done it for you

https://tomasrk.wordpress.com/2015/05/08/powershell-send-e-mails-w-autogenerated-passwords/

Needs tweaking to suit environment but that seems to be what you want?

Edited July 6, 2016 by sparkeh

howartp · July 6, 2016

function Create-RandomPassword 
( 
  [int] $minLength = 8, 
  [int] $maxLength = 8, 
  [bool] $useSymbols = $false, 
  [bool] $asSecureString = $false
) 
{ 
  [system.Security.Cryptography.RNGCryptoServiceProvider] $random = 
     new-object System.Security.Cryptography.RNGCryptoServiceProvider 
   
  # Get an array of all characters that can be used in the password 
  [string] $choice = Get-CharacterChoice -useSymbols $useSymbols 
   
  $randomPassword = $null 
  if (($minLength -le $maxLength) -and 
     ($minLength -ge 6)) 
  { 
     # Allocate a byte array of dimension 1 
     $randomNumber = new-object byte[] 1 
     if ($minLength -eq $maxLength) 
     { 
        [int] $length = $minLength 
     } 
     else 
     { 
        # Calculate a random length between minLength and maxLength 
        $random.GetBytes($randomNumber) 
        [int] $length = $minLength + $randomNumber[0] % 
                    ($maxLength - $minLength + 1) 
     } 
 
     # Allocate a byte array of dimension $length 
     $randomSequence = new-object byte[] $length 
     $hasUCase = $hasLCase = $hasNum = $false 
     while(!$hasUCase -or !$hasLCase -or !$hasNum) 
     { 
        # Generate random sequence of bytes 
        $random.GetBytes($randomSequence) 
         
        # Ensure that there is at least one number, uppercase 
        # character and lowercase character in the sequence. 
        $hasUCase = $hasLCase = $hasNum = $false 
        foreach($b in $randomSequence) 
        { 
           [char]$char = $choice[$b % $choice.Length] 
           if ($char -ge 'A' -and $char -le 'Z') 
           { 
              $hasUCase = $true 
           } 
            
           if ($char -ge 'a' -and $char -le 'z') 
           { 
              $hasLCase = $true 
           } 
            
           if ($char -ge '0' -and $char -le '9') 
           { 
              $hasNum = $true 
           } 
        } 
     } 
 
     if ($asSecureString) 
     { 
        $randomPassword = new-object System.Security.SecureString 
     } 
     else 
     { 
        [string] $randomPassword = '' 
     } 
      
     # Assign the password from the sequence of random bytes 
     foreach($b in $randomSequence) 
     { 
        [char]$char = $choice[$b % $choice.Length] 
        if ($asSecureString) 
        { 
           $randomPassword.AppendChar($char) 
        } 
        else 
        { 
           $randomPassword += $char 
        } 
     } 
  } 
   
  return $randomPassword 
} 

# Outputs an array of all the characters that the generated password 
# can be made up of. 
function Get-CharacterChoice 
( 
  [bool] $useSymbols = $true 
) 
{ 
  if ($useSymbols) 
  { 
     [string] $choice = '!"#$%&''()*+,-./' 
  } 
  else 
  { 
     [string] $choice = '' 
  } 
   
  $choice += '23456789' 
  if ($useSymbols) 
  { 
     $choice += ':;<=>?@' 
  } 
   
  $choice += 'ABCDEFGHJKMNPQRSTUVWXYZ' 
  if ($useSymbols) 
  { 
     $choice += '[\]^_`' 
  } 
   
  $choice += 'abcdefghjkmnpqrstuvwxyz' 
  if ($useSymbols) 
  { 
     $choice += '{|}~' 
  } 
   
  return $choice 
}

write-host "Importing GetPassword.ps1"
. "\\file\share\GetPassword.ps1"
$PassWord = Create-RandomPassword

That module (saved as GetPassword.ps1) plus code snippet should get you there.

The random password never contains 0o1iL.

Peter

Davit2005 · July 6, 2016

That script prompts for a password and waits for it to be entered, I'd like the script to choose the password itself and so be totally hands-off.

Caneasily make PowerShell generate a random code where the count = how long the password is.

$Password = ([char[]](Get-Random -Input $(48..57 + 65..90 + 97..122) -Count 5)) -join ""

Edited July 6, 2016 by elsiegee40

enjay · July 6, 2016

Thanks everyone, I'll take a look at those over the summer break.

strawberry · July 6, 2016

$newPassword = ([char[]](Get-Random -Input $(48..57 + 97..122) -Count 4)) -join ""

Set-ADAccountPassword -Identity "CN=Wifi Guest,OU=Guests,OU=New Students,OU=users,OU=school,DC=school,DC=local" -reset -NewPassword (ConvertTo-SecureString -AsPlainText $newPassword -Force)

[string]$body = @()

$body+= "new password for use with wifiguest account is " + $newPassword + " Please reply to this email when password has been distributed"

$body1+= "new password for use with wifiguest account is " + $newPassword + " Please reply to this email when password has been distributed #close"

Send-MailMessage -To [email protected]' -Body $body -Subject 'New Password for wifi guest account' -from '[email protected]' -smtpServer '10.0.0.26'

Send-MailMessage -To '[email protected]' -Body $body1 -Subject 'New Password for wifi guest account' -from '[email protected]' -smtpServer '10.0.0.26'

enjay · July 6, 2016

$newPassword = ([char[]](Get-Random -Input $(48..57 + 97..122) -Count 4)) -join ""
Set-ADAccountPassword -Identity "CN=Wifi Guest,OU=Guests,OU=New Students,OU=users,OU=school,DC=school,DC=local" -reset -NewPassword (ConvertTo-SecureString -AsPlainText $newPassword -Force)
[string]$body = @()
$body+= "new password for use with wifiguest account is " + $newPassword + " Please reply to this email when password has been distributed"
$body1+= "new password for use with wifiguest account is " + $newPassword + " Please reply to this email when password has been distributed #close"
Send-MailMessage -To [email protected]' -Body $body -Subject 'New Password for wifi guest account' -from '[email protected]' -smtpServer '10.0.0.26'
Send-MailMessage -To '[email protected]' -Body $body1 -Subject 'New Password for wifi guest account' -from '[email protected]' -smtpServer '10.0.0.26'

Well, that's the cleanest looking one so far. We don't have an onsite SMTP server, but assuming I can configure usernames/passwords into that Send-MailMessage command, I could use our ISP-provided one.

strawberry · July 14, 2016

i'd imagine it would work, if you need to auttnicate you can add smtp to iis and forward the email on. That script sends to sos which is our helpdesk, that way we have a record of the change.

DGardiner · February 26, 2018

$newPassword = ([char[]](Get-Random -Input $(48..57 + 97..122) -Count 4)) -join ""
Set-ADAccountPassword -Identity "CN=Wifi Guest,OU=Guests,OU=New Students,OU=users,OU=school,DC=school,DC=local" -reset -NewPassword (ConvertTo-SecureString -AsPlainText $newPassword -Force)
[string]$body = @()
$body+= "new password for use with wifiguest account is " + $newPassword + " Please reply to this email when password has been distributed"
$body1+= "new password for use with wifiguest account is " + $newPassword + " Please reply to this email when password has been distributed #close"
Send-MailMessage -To [email protected]' -Body $body -Subject 'New Password for wifi guest account' -from '[email protected]' -smtpServer '10.0.0.26'
Send-MailMessage -To '[email protected]' -Body $body1 -Subject 'New Password for wifi guest account' -from '[email protected]' -smtpServer '10.0.0.26'

Thanks for this, just used it as a base for our auto reset for all my schools! really simple too!

enjay · May 18, 2018

$newPassword = ([char[]](Get-Random -Input $(48..57 + 97..122) -Count 4)) -join ""
Set-ADAccountPassword -Identity "CN=Wifi Guest,OU=Guests,OU=New Students,OU=users,OU=school,DC=school,DC=local" -reset -NewPassword (ConvertTo-SecureString -AsPlainText $newPassword -Force)
[string]$body = @()
$body+= "new password for use with wifiguest account is " + $newPassword + " Please reply to this email when password has been distributed"
$body1+= "new password for use with wifiguest account is " + $newPassword + " Please reply to this email when password has been distributed #close"
Send-MailMessage -To [email protected]' -Body $body -Subject 'New Password for wifi guest account' -from '[email protected]' -smtpServer '10.0.0.26'
Send-MailMessage -To '[email protected]' -Body $body1 -Subject 'New Password for wifi guest account' -from '[email protected]' -smtpServer '10.0.0.26'

Zombie-thread alert!

Is that a Powershell script which I would save as a scheduled task on the server?

Alternatively, has anyone come up with a different/simpler option for scheduled password changes?

DGardiner · May 18, 2018

Zombie-thread alert!

Is that a Powershell script which I would save as a scheduled task on the server?

Alternatively, has anyone come up with a different/simpler option for scheduled password changes?

it is a powershell script, i ended up editing it to make my life simpler moving it between schools and doing multiple accounts

i know i could have used loops or whatever but its my first time using powershell!

posted it here as the code thing ate the formatting

https://gist.github.com/dgardiner87/7cef05013a1be75e8c431a786be6b18f

Edited May 18, 2018 by DGardiner

enjay · May 18, 2018

Right, I've got this working on our system (even sending the email through Google Mail), so thanks.

One question - can I set any controls over the password which is generated? At present, it is generating completely random passwords like oxz3p6rw and my worry is these are more likely to get written down than if I could set passwords like river74 or whatever.

howartp · May 18, 2018

One question - can I set any controls over the password which is generated? At present, it is generating completely random passwords like oxz3p6rw and my worry is these are more likely to get written down than if I could set passwords like river74 or whatever.

I do this for our guest student password, which is then emailed to a set of teachers every morning:

$subjects = "Maths","Geography","History","Science","French","German","Spanish","English","Drama","Music"
$subjectnum = Get-Random -Maximum 9 -minimum 0

$number = Get-Random -Maximum 999 -Minimum 111

$randomPasswordTxt = $subjects[$subjectnum] + $number
$randomPassword = ConvertTo-SecureString -string $randomPasswordTxt -AsPlainText -force

Generates passwords like Maths519, English726, Music931...

enjay · May 18, 2018

I do this for our guest student password, which is then emailed to a set of teachers every morning:
$subjects = "Maths","Geography","History","Science","French","German","Spanish","English","Drama","Music"
$subjectnum = Get-Random -Maximum 9 -minimum 0

$number = Get-Random -Maximum 999 -Minimum 111

$randomPasswordTxt = $subjects[$subjectnum] + $number
$randomPassword = ConvertTo-SecureString -string $randomPasswordTxt -AsPlainText -force
Generates passwords like Maths519, English726, Music931...

Right, that I like. Whereabouts do I put that code string in my PS script though? Do I just replace $newPassword = ([char[]](Get-Random -Input $(48..57 + 97..122) -Count 8)) -join "" with your code?

Edited May 18, 2018 by enjay

DGardiner · May 18, 2018

Right, that I like. Whereabouts do I put that code string in my PS script though? Do I just replace $newPassword = ([char[]](Get-Random -Input $(48..57 + 97..122) -Count 8)) -join "" with your code?

put his/her code above all of yours

and change the line:

$newPassword = ([char[]](Get-Random -Input $(48..57 + 97..122) -Count 4)) -join ""

to

$newPassword = $randomPassword

i think!

enjay · May 18, 2018

Nope. That returns a new password of System.Security.SecureString

DGardiner · May 18, 2018

Nope. That returns a new password of System.Security.SecureString

oops.... try

$newPassword = $randomPasswordTxt

enjay · May 18, 2018

Legendary, thanks!

howartp · May 18, 2018

Sorry, Edugeek popped to the corner shop when I tried to reply. By the time it got back, you'd already had the replies.

TTG_Alice · May 21, 2018

Not sure whether if you've heard of last pass? But you can generate passwords and share passwords with others without them seeing it.

https://www.lastpass.com/

Automatic Password Change

Recommended Posts

enjay

sparkeh

enjay

sparkeh

howartp

Davit2005

enjay

strawberry

enjay

strawberry

DGardiner

enjay

DGardiner

enjay

howartp

enjay

DGardiner

enjay

DGardiner

enjay

howartp

TTG_Alice

Create an account or sign in to comment

Create an account

Sign in

Recent Threads

Sage 200 budget holders - test something for me?

Bromcom Support

My Fluke LinkRunner has a fault...

Home

Forums

What's New