Domain User Password Changes

[SimonInOz]

Hi,

 

Whenever a user changes a password on our domain, they have to feed this into Outlook and several other areas which is a pain for users due to the number of prompts that come up.

 

Is there any way to feed a password update into all other applications they might use, so they only have to do it once?

 

Thanks

[HPlum78]

If your users change their passwords while they are logged on then this can cause issues, a log off and back on should solve this type of issue. Is this what is happening? what are the other applications? Where is your mail hosted?

[SimonInOz]

Office365, just looking to see how this is handled by others. We have a lot of students, and they also use wireless exclusively, so they get drop outs. When their passwords expire, they don't often log out, but will keep on working. When this happens, they get a requests for password updates to Outlook, and other Office applications. Just wanted to see if I could simplify it a bit, so they just change it once and it gets picked up by other applications. Not sure why this doesn't happen through credential manager?

[free780]

On Windows 10 personal devices workplace join should handle password changes. I did write a script that could email a user if their password was due to expire soon. There is an argument that if you have 2FA and Conditional Access that password expiry isn't needed.

 

Start-Transcript -Path "\password_expiry.log" -Append

$groupmembers = Get-ADGroupMember -Identity "Password Expiry Email"

foreach ($groupmember in $groupmembers)

{

 

$realname = Get-ADUser $groupmember -Properties samaccountname | Select-Object -ExpandProperty "Name"

$email = Get-ADUser $groupmember -Properties mail | Select-Object -ExpandProperty "Mail"

 

 

$expiredate = Get-Aduser $groupmember -Properties "msDS-UserPasswordExpiryTimeComputed" | Select-Object @{Name = "Password expires in" ; e={[datetime]::FromFileTime($_.“msDS-UserPasswordExpiryTimeComputed”)}} | Select-Object -ExpandProperty "Password expires in"

 

$todaydate = get-date

 

$daysleft = New-TimeSpan -Start $todaydate -End $expiredate | Select-Object -ExpandProperty "Days"

$hoursleft = New-TimeSpan -Start $todaydate -End $expiredate | Select-Object -ExpandProperty "Hours"

write-host -ForegroundColor Yellow "$realname have $daysleft days and $hoursleft hours until your password expires"

 

if ($daysleft -lt '3'){

$mailbody = "Hi $realname

 

You have $daysleft days and $hoursleft hours until your password expires.

 

Please change it before then by Pressing CTRL+ALT+DEL when logged in to a PC. Alternatively use the Office 365 Password Reset page if outside of ."

 

Send-MailMessage -SmtpServer "" -BodyAsHtml -Body $mailbody -Subject "Password Expiry" -From "[email protected]" -To $email -ErrorAction SilentlyContinue -Verbose}

Else

{Write-Host -ForegroundColor Yellow "More than 3 days left"}

}

 

Stop-Transcript

 

Please add a mail server. Allow the IP of the server you are running the script from.

I tied it down to a AD group while testing.

Create a scheduled task to run as service account with permissions to run scheduled tasks. It will need read permission to the correct attributes within AD.

 

samaccountname

Mail

Name

msDS-UserPasswordExpiryTimeComputed

Edited March 5, 2019 by free780