Password Expiration

[gomalley]

Not sure if this is Windows 10 or Server 2008R2/2012R2 related so posting here to start with.

 

All my technicians have started getting reminders from Windows that their password is due to expire, however the setting for password expiry is not set in any GPO's and the Password Settings Container on my 2012R2 DC does not have any expiration set.

 

Really confused as to what is causing it, and why it has started, the only network change we have made is to enforce MFA in our linked O365 accounts, but I can't find anything related to that causing password expiry on local AD users.

 

Anyone else experienced anything or have any idea.

 

Thanks

 

Guy

[mavhc]

In Active Directory Admin Centre there's password settings container, where you can set different rules for different groups, primary pupils min length 3, secondary min of 6, staff need complex pw. etc etc

[HPlum78]

function Get-UserPwdPolicy ($Identity)
{
   $UsrDetails = Get-ADUser -Identity $Identity -Properties *
   $Fgpp = (Get-ADUserResultantPasswordPolicy -Identity $Identity).Name
   [string]$Policy = switch ($Fgpp)
   {
       $null {"Default Policy"}
       {!($null)} {$Fgpp}
   }
   
   $Return = New-Object -TypeName PSObject
   $Return | Add-Member -MemberType NoteProperty -Name Identity -Value $Identity
   $Return | Add-Member -MemberType NoteProperty -Name PasswordPolicy -Value $Policy
   $Return | Add-Member -MemberType NoteProperty -Name Enabled -Value $UsrDetails.Enabled
   $Return | Add-Member -MemberType NoteProperty -Name 'Password Never Expires' $UsrDetails.PasswordNeverExpires
   $Return | Add-Member -MemberType NoteProperty -Name 'Password Last Set' $UsrDetails.PasswordLastSet
   $Return | Add-Member -MemberType NoteProperty -Name 'Password Expired' $UsrDetails.PasswordExpired
   $Return | Add-Member -MemberType NoteProperty -Name 'Canonical Name' $UsrDetails.CanonicalName


   return $Return
}

 

The above function will get the password policy being applied to an account.

 

if you want a very dirty way of getting the list out you can run the following:-

 

Get-ADUser -Filter * -Properties * | % {Get-UserPwdPolicy -Identity $_.samAccountName} | Export-Csv -Path C:\tmp\UserPwdPolicy.csv -Append -NoTypeInformation

 

not in code block as I always warn about running any command with -Filter * -Properties * (is bad just bad!)

 

hope it helps.

[jtotheb]

In Active Directory Admin Centre there's password settings container, where you can set different rules for different groups, primary pupils min length 3, secondary min of 6, staff need complex pw. etc etc

Nice one. I'd always done it the old fashioned 2008 way in ADSI Edit

[gomalley]

In Active Directory Admin Centre there's password settings container, where you can set different rules for different groups, primary pupils min length 3, secondary min of 6, staff need complex pw. etc etc

 

Thanks but that is the Password Settings Container I already mentioned - so not the cause

[HPlum78]

@gomalley have you passed a user that is having trouble in to the function I posted above? This will read the actual policy off the account and will help you track down what is going on.

[gomalley]

function Get-UserPwdPolicy ($Identity)
{
   $UsrDetails = Get-ADUser -Identity $Identity -Properties *
   $Fgpp = (Get-ADUserResultantPasswordPolicy -Identity $Identity).Name
   [string]$Policy = switch ($Fgpp)
   {
       $null {"Default Policy"}
       {!($null)} {$Fgpp}
   }
   
   $Return = New-Object -TypeName PSObject
   $Return | Add-Member -MemberType NoteProperty -Name Identity -Value $Identity
   $Return | Add-Member -MemberType NoteProperty -Name PasswordPolicy -Value $Policy
   $Return | Add-Member -MemberType NoteProperty -Name Enabled -Value $UsrDetails.Enabled
   $Return | Add-Member -MemberType NoteProperty -Name 'Password Never Expires' $UsrDetails.PasswordNeverExpires
   $Return | Add-Member -MemberType NoteProperty -Name 'Password Last Set' $UsrDetails.PasswordLastSet
   $Return | Add-Member -MemberType NoteProperty -Name 'Password Expired' $UsrDetails.PasswordExpired
   $Return | Add-Member -MemberType NoteProperty -Name 'Canonical Name' $UsrDetails.CanonicalName


   return $Return
}

 

The above function will get the password policy being applied to an account.

 

if you want a very dirty way of getting the list out you can run the following:-

 

Get-ADUser -Filter * -Properties * | % {Get-UserPwdPolicy -Identity $_.samAccountName} | Export-Csv -Path C:\tmp\UserPwdPolicy.csv -Append -NoTypeInformation

 

not in code block as I always warn about running any command with -Filter * -Properties * (is bad just bad!)

 

hope it helps.

 

Thanks, yes, using that I've identified that my Student policy in my Password Settings Container is working but my staff one is not, all staff and technicians are getting the "Default Policy"

 

It looks like it cannot find Universal Security Groups, only Global ones, having changed the security group to a Global one it now correctly applies, but wondering what caused me to change it to Universal before and therefore what I might now break!