Schedule of Password Expiration to a specific time

Question

Is there a way in Windows Server 2003 or 2008 and in Active Directory, to specify in a policy that when a users password expires that day, to have it expire at a certain time, say 4:00am.

The issue came up, because the expiration occurs during the middle of the working day, say 9:00am. Then when a user is already logged into Windows in the network, and using different applications, those will start behaving wrongly because of authentication. They have to log out and log back in, in order for Windows to ask for the new password.

So, if when they log in early in the morning it would ask for the new password, then they won't have to log back out during the working day.

One of the AD Admins said: "Have them check if their password will expire before starting the day".. but really, who does that?

And I don't have access to an AD to check these types of policies. So, is this possible?

Answer 1

AFAIK this is not possible.

There are multiple reminder notifications that can take place stating that the current password will expire in N days and offering the option to change it. If the user opts to ignore this reminder then they are unfortunately digging their own grave.

Answer 2

We've got a similar problem.

The only way I can think of is to run a script every night that will go through active directory and identify which account will expire the next day. If it does, flag it to change the password. The code would look something like the following; I've not tried running this script so it might need a little tweaking:

Const SEC_IN_DAY = 86400 Const ADS_UF_DONT_EXPIRE_PASSWD = &h10000 Const ADS_SCOPE_SUBTREE = 1000

dim strname dim strdist dim dtmvalue

on error resume next

    Set objConnection = CreateObject("ADODB.Connection")
    Set objCommand =   CreateObject("ADODB.Command")
    objConnection.Provider = "ADsDSOObject"
    objConnection.Open "Active Directory Provider"
    Set objCommand.ActiveConnection = objConnection
    objCommand.Properties("Page Size") = 1000
    objCommand.Properties("Searchscope") = ADS_SCOPE_SUBTREE 
    objCommand.CommandText = "SELECT distinguishedName, profilepath, name from 'LDAP://dc=Example,dc=com' where objectCategory = 'User'"        


 Set objuserRecordSet = objCommand.Execute

objUSerRecordSet.MoveFirst

Do Until objuserRecordSet.EOF

strdist = objuserRecordSet.Fields("distinguishedName").Value
strname = objuserRecordSet.Fields("name").Value

Set objUserLDAP = GetObject _ 
("LDAP://" & strdist) 

intCurrentValue = objUserLDAP.Get("userAccountControl") 

    dtmValue = objUserLDAP.PasswordLastChanged  

    If intCurrentValue and ADS_UF_DONT_EXPIRE_PASSWD Then 
        x  =  "The password does not expire." 
    Else 
            Set objDomainNT = GetObject("WinNT://escc.gov.uk") 
            intMaxPwdAge = objDomainNT.Get("MaxPasswordAge") 
                If intMaxPwdAge < 0 Then 
                    x  = "Password does not expire" 
                Else
                    intMaxPwdAge=intMaxPwdAge/86400
                    strold = ((dtmValue + intMaxPwdAge)-now)

                    if strold < 2 and strold > 0 then
                        objUserLDAP.pwdLastSet = 0
                        objUserLDAP.SetInfo
                    end if
                end if

    End If 

dtmValue= ""

objuserrecordset.movenext   

Loop