localzuk Posted May 1, 2018 Posted May 1, 2018 We've run an 802.1x wireless network for a while now, and we've always had the issue that when someone's password changes, their iOS device doesn't know this and keeps trying their old password and ends up locking the account. The only way around it is to forget the wireless network and rejoin manually. Does anyone have a more elegant way of doing this? I am wanting to roll out a Trust-wide wireless network that uses 802.1x, and would love to have a way around this!
FN-GM Posted May 1, 2018 Posted May 1, 2018 Not the best solution but it does help. Some wireless solutions can be configure to stop the devices authenticating after X amount of failed attempts. If your AD lockout attempts is 5 failed attempts you could configure your wireless to stop after 4 attempts so this will stop the account lockout issues.
localzuk Posted May 1, 2018 Author Posted May 1, 2018 That'd help, definitely. I think combining that with an automated email when their password is expiring would improve things. Just wish there was a proper solution.
RLR Posted May 1, 2018 Posted May 1, 2018 That'd help, definitely. I think combining that with an automated email when their password is expiring would improve things. Just wish there was a proper solution. We have an automated email that sends an email once a day for 20 days to tell them their password will expire. We even have a web link on their iPad where they can change it on their iPad. We still get quit a few students come in saying their wifi isn't working and find out they've just ignore the emails! For the automated email we use a powershell script. For changing ad passwords on the iPad we use Passcore.
FN-GM Posted May 1, 2018 Posted May 1, 2018 We have an automated email that sends an email once a day for 20 days to tell them their password will expire. We even have a web link on their iPad where they can change it on their iPad. We still get quit a few students come in saying their wifi isn't working and find out they've just ignore the emails! For the automated email we use a powershell script. For changing ad passwords on the iPad we use Passcore. Any chance you could share that script please?
RLR Posted May 1, 2018 Posted May 1, 2018 (edited) Yep, it's one I found on the internet and tweeked. It's a bit old now so might be an updated version somewhere. There's a few things that you will need to change such as the body of the email and the variables. There is a testing variable to test it which is handy. ################################################################################################################## # Version 1.4 February 2016# Robert Pearman (WSSMB MVP)# TitleRequired.com# Script to Automated Email Reminders when Users Passwords due to Expire.## Requires: Windows PowerShell Module for Active Directory## For assistance and ideas, visit the TechNet Gallery Q&A Page. http://gallery.technet.microsoft.com/Password-Expiry-Email-177c3e27/view/Discussions#content# Or Checkout my Youtube Channel - https://www.youtube.com/user/robtitlerequired#################################################################################################################### Please Configure the following variables....$smtpServer="smtp-relay.gmail.com"$expireindays = 20$from = "IT Department "$logging = "Disabled" # Set to Disabled to Disable Logging$logFile = "c:\scripts\mylog.csv" # ie. c:\mylog.csv$testing = "Disabled" # Set to Disabled to Email Users$testRecipient = "[email protected]"$link = "https://linktowebsite.com"$logo = "https://linktologo.png"##################################################################################################################### Check Logging Settingsif (($logging) -eq "Enabled"){ # Test Log File Path $logfilePath = (Test-Path $logFile) if (($logFilePath) -ne "True") { # Create CSV File and Headers New-Item $logfile -ItemType File Add-Content $logfile "Date,Name,EmailAddress,DaystoExpire,ExpiresOn,Notified" }} # End Logging Check# System Settings$textEncoding = [system.Text.Encoding]::UTF8$date = Get-Date -format ddMMyyyy# End System Settings# Get Users From AD who are Enabled, Passwords Expire and are Not Currently ExpiredImport-Module ActiveDirectory$users = get-aduser -SearchBase "CHANGE THIS TO YOUR OU OF USERS YOU WANT TO SET THIS AGAINST" -filter * -properties Name, PasswordNeverExpires, PasswordExpired, PasswordLastSet, EmailAddress |where {$_.Enabled -eq "True"} | where { $_.PasswordNeverExpires -eq $false } | where { $_.passwordexpired -eq $false }$DefaultmaxPasswordAge = (Get-ADDefaultDomainPasswordPolicy).MaxPasswordAge# Process Each User for Password Expiryforeach ($user in $users){ $Name = $user.Name $emailaddress = $user.emailaddress $passwordSetDate = $user.PasswordLastSet $PasswordPol = (Get-AduserResultantPasswordPolicy $user) $sent = "" # Reset Sent Flag # Check for Fine Grained Password if (($PasswordPol) -ne $null) { $maxPasswordAge = ($PasswordPol).MaxPasswordAge } else { # No FGP set to Domain Default $maxPasswordAge = $DefaultmaxPasswordAge } $expireson = $passwordsetdate + $maxPasswordAge $today = (get-date) $daystoexpire = (New-TimeSpan -Start $today -End $Expireson).Days # Set Greeting based on Number of Days to Expiry. # Check Number of Days to Expiry $messageDays = $daystoexpire if (($messageDays) -gt "1") { $messageDays = "in " + "$daystoexpire" + " days." } else { $messageDays = "today." } # Email Subject Set Here $subject="Your password will expire $messageDays" # Email Body Set Here, Note You can use HTML, including Images. $body =" Dear $name, Your Computer login Password will expire $messageDays Edit this text to say what you want Remove lines if you need To change your password on a PC press CTRL+ALT+Delete and choose Change Password To change your password on your iPad (only works inside the school network), please click this link, or visit the Password WebLink icon on your iPad - this will only work whilst on the school wifi. Kind Regards, " # If Testing Is Enabled - Email Administrator if (($testing) -eq "Enabled") { $emailaddress = $testRecipient } # End Testing # If a user has no email address listed if (($emailaddress) -eq $null) { $emailaddress = $testRecipient }# End No Valid Email # Send Email Message if (($daystoexpire -ge "0") -and ($daystoexpire -lt $expireindays)) { $sent = "Yes" # If Logging is Enabled Log Details if (($logging) -eq "Enabled") { Add-Content $logfile "$date,$Name,$emailaddress,$daystoExpire,$expireson,$sent" } # Send Email Message Send-Mailmessage -smtpServer $smtpServer -from $from -to $emailaddress -subject $subject -body $body -bodyasHTML -priority High -Encoding $textEncoding } # End Send Message else # Log Non Expiring Password { $sent = "No" # If Logging is Enabled Log Details if (($logging) -eq "Enabled") { Add-Content $logfile "$date,$Name,$emailaddress,$daystoExpire,$expireson,$sent" } } } # End User Processing# End Not sure why the code box is going to one line. Use this link instead. This link only lasts one week: https://paste.ofcode.org/CL8uPQB8Cm6xBx2yGMrgHD Edited May 1, 2018 by RLR 1
Norphy Posted May 1, 2018 Posted May 1, 2018 You could use certificates to join the people to the wireless network, rather than passwords? They'd only expire one a year/two years/three years then.
Blue_Cookeh Posted May 1, 2018 Posted May 1, 2018 You could use certificates to join the people to the wireless network, rather than passwords? They'd only expire one a year/two years/three years then. This was going to be my suggestion. I would look at using something like https://www.ruckuswireless.com/products/smart-wireless-services/cloudpath - I really like the enrolment process that XpressConnect gives users.
localzuk Posted May 1, 2018 Author Posted May 1, 2018 This was going to be my suggestion. I would look at using something like https://www.ruckuswireless.com/products/smart-wireless-services/cloudpath - I really like the enrolment process that XpressConnect gives users. Is that Ruckus only? We have other wireless solutions in our Trust too.
Blue_Cookeh Posted May 3, 2018 Posted May 3, 2018 (edited) Is that Ruckus only? We have other wireless solutions in our Trust too. Yeah I think it's Ruckus only... although judging by their website that might have changed, their video suggests it works across 'different vendor networks' so might be worth talking to them. The way it worked when I deployed it years ago was users would download the XpressConnect app which would join their device to a hidden Enrolment network, the user could then login with their usual credentials, then the app went off and requested a device certificate from your internal CA and setup a connection profile on the device before removing the Enrolment network - that way the device was setup with barely any user interaction and they were always fully authenticated on your network. Aruba ClearPass contains similar functionality (amongst a ton more) that I've heard is very good. It wouldn't surprise me if Cisco/Meraki had one either but I don't have any experience with the software side of them unfortunately. Edited May 3, 2018 by Blue_Cookeh
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now