Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Is there a way in Windows Server 2003 or 2008 and in Active Directory, to specify in a policy that when a users password expires that day, to have it expire at a certain time, say 4:00am.

The issue came up, because the expiration occurs during the middle of the working day, say 9:00am. Then when a user is already logged into Windows in the network, and using different applications, those will start behaving wrongly because of authentication. They have to log out and log back in, in order for Windows to ask for the new password.

So, if when they log in early in the morning it would ask for the new password, then they won't have to log back out during the working day.

One of the AD Admins said: "Have them check if their password will expire before starting the day".. but really, who does that?

And I don't have access to an AD to check these types of policies. So, is this possible?

share|improve this question
add comment

2 Answers

AFAIK this is not possible.

There are multiple reminder notifications that can take place stating that the current password will expire in N days and offering the option to change it. If the user opts to ignore this reminder then they are unfortunately digging their own grave.

share|improve this answer
3  
+1 for "read the warning messages" –  Dave M Feb 4 '11 at 15:56
    
As they say, RTFM –  BBlake Feb 4 '11 at 16:47
    
I know it is like that. The 100 or so users ignore this. Im trying to find a way to ease everyone's pain –  elcool Apr 3 '11 at 17:18
add comment

We’ve got a similar problem.

The only way I can think of is to run a script every night that will go through active directory and identify which account will expire the next day. If it does, flag it to change the password. The code would look something like the following; I've not tried running this script so it might need a little tweaking:

Const SEC_IN_DAY = 86400 
Const ADS_UF_DONT_EXPIRE_PASSWD = &h10000 
Const ADS_SCOPE_SUBTREE = 1000

dim strname
dim strdist
dim dtmvalue

on error resume next


        Set objConnection = CreateObject("ADODB.Connection")
        Set objCommand =   CreateObject("ADODB.Command")
        objConnection.Provider = "ADsDSOObject"
        objConnection.Open "Active Directory Provider"
        Set objCommand.ActiveConnection = objConnection
        objCommand.Properties("Page Size") = 1000
        objCommand.Properties("Searchscope") = ADS_SCOPE_SUBTREE 
        objCommand.CommandText = "SELECT distinguishedName, profilepath, name from 'LDAP://dc=Example,dc=com' where objectCategory = 'User'"        


     Set objuserRecordSet = objCommand.Execute

objUSerRecordSet.MoveFirst

Do Until objuserRecordSet.EOF  

    strdist = objuserRecordSet.Fields("distinguishedName").Value
    strname = objuserRecordSet.Fields("name").Value

    Set objUserLDAP = GetObject _ 
    ("LDAP://" & strdist) 

    intCurrentValue = objUserLDAP.Get("userAccountControl") 

        dtmValue = objUserLDAP.PasswordLastChanged  

        If intCurrentValue and ADS_UF_DONT_EXPIRE_PASSWD Then 
            x  =  "The password does not expire." 
        Else 
                Set objDomainNT = GetObject("WinNT://escc.gov.uk") 
                intMaxPwdAge = objDomainNT.Get("MaxPasswordAge") 
                    If intMaxPwdAge < 0 Then 
                        x  = "Password does not expire" 
                    Else
                        intMaxPwdAge=intMaxPwdAge/86400
                        strold = ((dtmValue + intMaxPwdAge)-now)

                        if strold < 2 and strold > 0 then
                            objUserLDAP.pwdLastSet = 0
                            objUserLDAP.SetInfo
                        end if
                    end if

        End If 

    dtmValue= ""

    objuserrecordset.movenext   

Loop
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.