Powershell webrequest to reset (bulk) passwords

[HD-Design]

So I have somehow been landed with a project, that I've previously had zero input on, so would appreciate any assistance..

 

Our company tool has internal accounts for students to use when we deliver training, these accounts are local to the tool and not using SSO via AAD or anything (I suggested this as it would make things soooooo easy, but customer firewalls made this an issue so we've had to opt for local accounts). At the end of a weeks training, we would like the delivering member of staff to be able to click a button and reset all the student accounts. So far I've got a rudamentory internal website where they can enter Shard/Location (US or Europe) and which student orgs they want to reset. On submitting the form it will simulate hitting the forgot password button for all of these accounts, and it will deliver emails to then reset the passwords for all of these accounts. The gold-standard would be to actually reset the password (even if to a single value for all) without the need for the manual overhead with the solution as I have it today.

 

[color=#0000FF][font=Consolas]function[/font][/color][color=#000000][font=Consolas] password-reset {[/font][/color][color=#000000][font=Consolas]  [CmdletBinding()]
 [color=#0000ff]param[/color](
   [Parameter()]
   [string] [color=#001188]$orgId[/color],
       [string] [color=#001188]$shard[/color],
       [string] [color=#001188]$name[/color],
       [string] [color=#001188]$studentemail[/color]
 )

[color=#001188]$session[/color] = New-Object Microsoft.PowerShell.Commands.WebRequestSession
[color=#001188]$session[/color].UserAgent = [color=#a31515]"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36"[/color]


  [color=#0000ff]if[/color] ([color=#001188]$shard[/color] -eq [color=#a31515]'eu'[/color]) {
[color=#001188]$strHeader[/color] = @{
[color=#a31515]"authority"[/color]=[color=#a31515]"login.domain.eu"[/color]
 [color=#a31515]"method"[/color]=[color=#a31515]"POST"[/color]
 [color=#a31515]"path"[/color]=[color=#a31515]"/user/reset-password"[/color]
 [color=#a31515]"scheme"[/color]=[color=#a31515]"https"[/color]
 [color=#a31515]"accept"[/color]=[color=#a31515]"*/*"[/color]
 [color=#a31515]"accept-encoding"[/color]=[color=#a31515]"gzip, deflate, br"[/color]
 [color=#a31515]"accept-language"[/color]=[color=#a31515]"en-US,en;q=0.9"[/color]
 [color=#a31515]"origin"[/color]=[color=#a31515]"https://app.domain.eu"[/color]
 [color=#a31515]"referer"[/color]=[color=#a31515]"https://app.domain.eu/"[/color]
 [color=#a31515]"sec-ch-ua"[/color]=[color=#a31515]"`" Not A;Brand`";v=`"99`", `"Chromium`";v=`"102`", `"Google Chrome`";v=`"102`""[/color]
 [color=#a31515]"sec-ch-ua-mobile"[/color]=[color=#a31515]"?0"[/color]
 [color=#a31515]"sec-ch-ua-platform"[/color]=[color=#a31515]"`"Windows`""[/color]
 [color=#a31515]"sec-fetch-dest"[/color]=[color=#a31515]"empty"[/color]
 [color=#a31515]"sec-fetch-mode"[/color]=[color=#a31515]"cors"[/color]
 [color=#a31515]"sec-fetch-site"[/color]=[color=#a31515]"same-site"[/color]
} 
 
 [color=#001188]$strBody[/color] = [color=#a31515]"{`"email`":`"[/color][color=#001188]$studentemail[/color][color=#a31515]`",`"setPasswordUrl`":`"https://app.domain.eu/password/reset`"}"[/color] 
 Invoke-WebRequest -UseBasicParsing -Uri [color=#a31515]"https://login.domain.eu/user/reset-password"[/color] -Method [color=#a31515]"POST"[/color] -WebSession [color=#001188]$session[/color] -Headers [color=#001188]$strHeader[/color] -ContentType [color=#a31515]"application/json"[/color] -Body [color=#001188]$strBody[/color]

 
 }
 [color=#0000ff]else[/color]  {

[color=#001188]$strHeader[/color] = @{
[color=#a31515]"authority"[/color]=[color=#a31515]"login.domain.com"[/color]
 [color=#a31515]"method"[/color]=[color=#a31515]"POST"[/color]
 [color=#a31515]"path"[/color]=[color=#a31515]"/user/reset-password"[/color]
 [color=#a31515]"scheme"[/color]=[color=#a31515]"https"[/color]
 [color=#a31515]"accept"[/color]=[color=#a31515]"*/*"[/color]
 [color=#a31515]"accept-encoding"[/color]=[color=#a31515]"gzip, deflate, br"[/color]
 [color=#a31515]"accept-language"[/color]=[color=#a31515]"en-US,en;q=0.9"[/color]
 [color=#a31515]"origin"[/color]=[color=#a31515]"https://app.domain.com"[/color]
 [color=#a31515]"referer"[/color]=[color=#a31515]"https://app.domain.com/"[/color]
 [color=#a31515]"sec-ch-ua"[/color]=[color=#a31515]"`" Not A;Brand`";v=`"99`", `"Chromium`";v=`"102`", `"Google Chrome`";v=`"102`""[/color]
 [color=#a31515]"sec-ch-ua-mobile"[/color]=[color=#a31515]"?0"[/color]
 [color=#a31515]"sec-ch-ua-platform"[/color]=[color=#a31515]"`"Windows`""[/color]
 [color=#a31515]"sec-fetch-dest"[/color]=[color=#a31515]"empty"[/color]
 [color=#a31515]"sec-fetch-mode"[/color]=[color=#a31515]"cors"[/color]
 [color=#a31515]"sec-fetch-site"[/color]=[color=#a31515]"same-site"[/color]
} 

[color=#001188]$strBody[/color] = [color=#a31515]"{`"email`":`"[/color][color=#001188]$studentemail[/color][color=#a31515]`",`"setPasswordUrl`":`"https://app.domain.com/password/reset`"}"[/color] 
Invoke-WebRequest -UseBasicParsing -Uri [color=#a31515]"https://login.domain.com/user/reset-password"[/color] -Method [color=#a31515]"POST"[/color] -WebSession [color=#001188]$session[/color] -Headers [color=#001188]$strHeader[/color] -ContentType [color=#a31515]"application/json"[/color] -Body [color=#001188]$strBody[/color]} 

}

[/font][/color]

 

any help at all to refine this solution would be greatly appreciated!

 

Thanks!

HD

[howartp]

$Expiry = Get-Date -Hour 15 -Minute 15 -Second 00
write-host "Account Expiries will be set to: " $Expiry  #Today at 3.15pm

Import-Module ActiveDirectory

$subjects = "Maths","Geography","History","Science","French","German","Spanish","English","Drama","Music"
$subjectnum = Get-Random -Maximum 9 -minimum 0
#$subjects[$subjectnum]

$number = Get-Random -Maximum 999 -Minimum 111
#$number


$randomPasswordTxt = $subjects[$subjectnum] + $number
#$randomPasswordTxt
$randomPassword = ConvertTo-SecureString -string $randomPasswordTxt -AsPlainText -force


Set-ADUser fred -AccountExpirationDate $Expiry
Set-ADAccountPassword fred -reset -newpassword $randomPassword

write-host "Account updated"

Send-MailMessage -SmtpServer "192.168.x.x" -From "[email protected]" -To $("[email protected]") -Subject "Guest account" -Body $("Account for guest students:`r`n`r`nUsername: fred`r`nPassword: $randomPasswordTxt`r`n`r`nThis password will expire at 3.15pm.`r`n`r`nYou will receive a new one at 8am.`r`n`r`nIT Support.") 

write-host "Email sent"

The above code is what we use to reset the password for our guest student account each day (it runs on task at 8am) and automatically expires the password at 3.15pm

 

It may be worth reconsidering your workflow, so that when you actually setup the accounts for the given days/weeks training, you automatically set them to expire at the end of the day/week?

 

Alternatively:

 

Disable-ADAccount -Identity fred

That will disable the account, rather than setting the password and/or password expiry as such.

[HD-Design]

Unfortunately as mentioned the accounts are not AAD accounts, they are local to the tool, I was just hoping looking at my code somebody may of had a better suggestion to automate the process. I will keep exploring on my side

[howartp]

Apologies, I presumed you meant they were local AD accounts rather than Azure AD accounts.

 

If this is a custom tool then I doubt any of us can advise further.

[chaplic]

I don't see you passing any useful data to the form. Have you used F12 dev tools or fiddler to looksee what form fields are being submitted when you complete the process 'for real'?

 

 

Also I assume the form you are calling is authenticated itself? this will need to be done too.

Edited May 30, 2022 by chaplic