Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way in Windows Server 2003 or 2008 and in Active Directory, to specify in a policy that when a users password expires that day, to have it expire at a certain time, say 4:00am.

The issue came up, because the expiration occurs during the middle of the working day, say 9:00am. Then when a user is already logged into Windows in the network, and using different applications, those will start behaving wrongly because of authentication. They have to log out and log back in, in order for Windows to ask for the new password.

So, if when they log in early in the morning it would ask for the new password, then they won't have to log back out during the working day.

One of the AD Admins said: "Have them check if their password will expire before starting the day".. but really, who does that?

And I don't have access to an AD to check these types of policies. So, is this possible?

share|improve this question

AFAIK this is not possible.

There are multiple reminder notifications that can take place stating that the current password will expire in N days and offering the option to change it. If the user opts to ignore this reminder then they are unfortunately digging their own grave.

share|improve this answer
+1 for "read the warning messages" – Dave M Feb 4 '11 at 15:56
As they say, RTFM – BBlake Feb 4 '11 at 16:47
I know it is like that. The 100 or so users ignore this. Im trying to find a way to ease everyone's pain – elcool Apr 3 '11 at 17:18

We’ve got a similar problem.

The only way I can think of is to run a script every night that will go through active directory and identify which account will expire the next day. If it does, flag it to change the password. The code would look something like the following; I've not tried running this script so it might need a little tweaking:

Const SEC_IN_DAY = 86400 

dim strname
dim strdist
dim dtmvalue

on error resume next

        Set objConnection = CreateObject("ADODB.Connection")
        Set objCommand =   CreateObject("ADODB.Command")
        objConnection.Provider = "ADsDSOObject"
        objConnection.Open "Active Directory Provider"
        Set objCommand.ActiveConnection = objConnection
        objCommand.Properties("Page Size") = 1000
        objCommand.Properties("Searchscope") = ADS_SCOPE_SUBTREE 
        objCommand.CommandText = "SELECT distinguishedName, profilepath, name from 'LDAP://dc=Example,dc=com' where objectCategory = 'User'"        

     Set objuserRecordSet = objCommand.Execute


Do Until objuserRecordSet.EOF  

    strdist = objuserRecordSet.Fields("distinguishedName").Value
    strname = objuserRecordSet.Fields("name").Value

    Set objUserLDAP = GetObject _ 
    ("LDAP://" & strdist) 

    intCurrentValue = objUserLDAP.Get("userAccountControl") 

        dtmValue = objUserLDAP.PasswordLastChanged  

        If intCurrentValue and ADS_UF_DONT_EXPIRE_PASSWD Then 
            x  =  "The password does not expire." 
                Set objDomainNT = GetObject("WinNT://") 
                intMaxPwdAge = objDomainNT.Get("MaxPasswordAge") 
                    If intMaxPwdAge < 0 Then 
                        x  = "Password does not expire" 
                        strold = ((dtmValue + intMaxPwdAge)-now)

                        if strold < 2 and strold > 0 then
                            objUserLDAP.pwdLastSet = 0
                        end if
                    end if

        End If 

    dtmValue= ""


share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .