Disable password expiration for remote staff

[enjay]

We currently have a password policy (or rather, rules within the Default Domain Policy) which set all passwords to expire after 90 days. This is going to cause us problems as these passwords start expiring, for two reasons. Firstly, AzureAD's self-service password reset doesn't seem to be working, and secondly staff are all working from laptops with caches profiles so presumably passwords not matching would be an issue (apparently in the past when staff passwords have expied while they're off-site, my technicians have "reset" their password to its current value).

 

So my question is, can I prevent the password expiration from happening? It's a computer policy in AD, so I don't think changing it while the laptops are off-site will take effect.

Edited April 15, 2020 by enjay

[Katy]

If they're using AD accounts then, as far as I'm aware, the individual laptops won't know they are expired unless they attempt to authenticate against a DC, and the password policy applied to the computers themselves applies to local accounts. So in theory if you alter the password policy applying to the domain controllers you should be good.

[mullet_man]

You need to set Password Never Expires for each user in AD.

 

This will override your group policy.

 

[enjay]

If they're using AD accounts then, as far as I'm aware, the individual laptops won't know they are expired unless they attempt to authenticate against a DC, and the password policy applied to the computers themselves applies to local accounts. So in theory if you alter the password policy applying to the domain controllers you should be good.

 

They're not local accounts as such on the computers, they're the domain account but with local settings and cached profiles etc. to allow remote working.

[enjay]

You need to set Password Never Expires for each user in AD.

 

This will override your group policy.

 

[ATTACH]57629[/ATTACH]

 

Good job Wise Soft can do that in bulk!

[thimon]

Good job Wise Soft can do that in bulk!

Or PowerShell?

[enjay]

Or PowerShell?

 

Powershell is one of those things on my "learn more about this" list. Maybe the closure will give me the opportunity to do that.

[thimon]

Powershell is one of those things on my "learn more about this" list. Maybe the closure will give me the opportunity to do that.

I would say you just need to know the basics and how it can work for you, you don't actually need to know all the commands from memory. Ideally you need to get to a point when you find a command or PowerShell script online that does what you want, look at it and understand what it's doing, then tailor it to your needs / school / OU structure. Will look good on your CV if you can get to grips with it.

[Sephiroth]

Or PowerShell?

 

This is how I did it:

 

$Users = Get-ADUser -SearchBase "OU=UserAccounts,DC=example,DC=net" -Filter * -Properties PasswordNeverExpires,ExtensionAttribute11
$UCount = $Users.Count

$I = 1
Foreach ($User in $Users) {
   $Name = $User.SamAccountName
   $PWExpiry = $User.PasswordNeverExpires
   $EA11 = $User.ExtensionAttribute11

   $Percent = [Math]::Truncate($I/$UCount*100)
   Write-Progress -Activity "Disabling Password Expiration" -CurrentOperation "Getting status for user: $Name" -PercentComplete $Percent -Status "$Percent% Complete | $I/$UCount"
   
   If ($PWExpiry -eq $False) {
       Write-Progress -Activity "Disabling Password Expiration" -CurrentOperation "Disabling Expiration for user: $Name" -PercentComplete $Percent -Status "$Percent% Complete | $I/$UCount"
       Set-ADUser -Identity $Name -Add @{extensionAttribute11 = "ExpirePW"}
       Set-ADUser -Identity $Name -PasswordNeverExpires $True
   }

   $I++
}

 

Gets the status for each user, and if it needs to set the password to never expire, writes "ExpirePW" into 'ExtensionAttribute11' so that you can easily undo it afterwards.

Edited April 16, 2020 by Sephiroth

[enjay]

I would say you just need to know the basics and how it can work for you, you don't actually need to know all the commands from memory. Ideally you need to get to a point when you find a command or PowerShell script online that does what you want, look at it and understand what it's doing, then tailor it to your needs / school / OU structure. Will look good on your CV if you can get to grips with it.

 

Totally agree. For my own working and also that of my team, I'm not interested in finding staff who can recite PowerShell from memory, or indeed perform lots of other tasks from memory. I'm interested in people who can effectively find the information when they need it, and write concise instructions for themselves and others to follow.

[enjay]

Gets the status for each user, and if it needs to set the password to never expire, writes "ExpirePW" into 'ExtensionAttribute11' so that you can easily undo it afterwards.

 

Ah, now that I like. Have you got the corresponding PS to reverse this in September?

[Sephiroth]

Ah, now that I like. Have you got the corresponding PS to reverse this in September?

 

$Users = Get-ADUser -SearchBase "OU=UserAccounts,DC=example,DC=net" -Filter * -Properties PasswordNeverExpires,ExtensionAttribute11
$UCount = $Users.Count

$I = 1
Foreach ($User in $Users) {
   $Name = $User.SamAccountName
   $PWExpiry = $User.PasswordNeverExpires
   $EA11 = $User.ExtensionAttribute11

   $Percent = [Math]::Truncate($I/$UCount*100)
   Write-Progress -Activity "Re-Setting Password Expiration" -CurrentOperation "Getting status for user: $Name" -PercentComplete $Percent -Status "$Percent% Complete | $I/$UCount"
   
   If ($EA11 -eq "ExpirePW" -and $PWExpiry -eq $True) {
       Write-Progress -Activity "Re-Setting Password Expiration" -CurrentOperation "Disabling Expiration for user: $Name" -PercentComplete $Percent -Status "$Percent% Complete | $I/$UCount"
       Set-ADUser -Identity $Name -Clear "extensionAttribute11"
       Set-ADUser -Identity $Name -PasswordNeverExpires $False
   }

   $I++
}

 

[Sephiroth]

Totally agree. For my own working and also that of my team, I'm not interested in finding staff who can recite PowerShell from memory, or indeed perform lots of other tasks from memory. I'm interested in people who can effectively find the information when they need it, and write concise instructions for themselves and others to follow.

 

I second this. I can't recite much, but Know the basic construct and know how to find information, then put the 2 together in a coherent script. That's all I look for in a technician.

[enjay]

I second this. I can't recite much, but Know the basic construct and know how to find information, then put the 2 together in a coherent script. That's all I look for in a technician.

 

Wondering OT now, but I'd actually value that skill in an applicant over the one who could recite PowerShell. IT is constantly changing, and I want to employ someone who can respond to those changes and keep learning, rather than one who swallowed a course guide 2 years ago. Also, information in someone's head is risky - what if that person is absent or leaves?

[Ex-MGSTech]

Specops have just published a free utility to stop this happening:

 

https://specopssoft.com/blog/password-expiration-email/?utm_source=pardot&utm_medium=email&utm_campaign=newsletter

[enjay]

Specops have just published a free utility to stop this happening:

 

https://specopssoft.com/blog/password-expiration-email/?utm_source=pardot&utm_medium=email&utm_campaign=newsletter

 

I don't think that helps in this instance. Part of my problem is users don't seem able to change their password remotely, as the AzureAD self-service reset doesn't work (it just says "this isn't working just now, try again later" or similar). Linked to that, even if they did change their AD/Azure password, I don't see how that would change the password in their cached logon on the laptop. Or am I missing something?

 

We have got a VPN. If users did a Ctrl-Alt-Del while on the VPN, would that change everything for them?

[Boredguy]

You can't change the cached password until they are reconnected to the network. Which confused some of our staff who never brought their laptop in for months so they had a really old one working on the laptop compared to on the network

[enjay]

You can't change the cached password until they are reconnected to the network. Which confused some of our staff who never brought their laptop in for months so they had a really old one working on the laptop compared to on the network

 

Ah, so if we changed their password in AD, or through AzureAD self-service reset if that decides to work, they could carry on just with one password for domain connections and their old one to log in to the laptop itself?

[Boredguy]

Thats certainly how we've operated for the last 15 years with staff who can't understand how to bring things in "regularly" as per the agreement @enjay (well those that still have laptops which is very few now)

[enjay]

Bringing laptops in regularly isn't an issue for us - no PCs in classrooms!