Password Expiry Notice: how would/do you do it

jackgreene2 · 2016-10-27T16:06:26.000Z

I recently implemented the following script as a daily scheduled task. It has been running for 2 weeks successfully. I have a few questions. Does anyone else do this or something similar in production? I typically like SOME error checking, but I’m not so sure it’s necessary in this circumstance; where might this code hang? Lastly, what changes would you make, how would you make this more efficient? Thanks for the input, all.

$primary = get-aduser -filter {(enabled -eq $true)} -properties employeetype, pwdlastset, passwordexpired, passwordneverexpires, emailaddress | 
           select employeetype,samaccountname, pwdlastset, passwordexpired, passwordneverexpires, emailaddress, `
                  @{l='pwddaysremaining';e={(([datetime]::fromfiletime($_.pwdlastset)).adddays(90) - (get-date)).days}}, `
                  @{l='pwdexpireson';e={([datetime]::fromfiletime($_.pwdlastset)).adddays(90)}} | 
           ?{($_.passwordexpired -ne $true) -and ($_.passwordneverexpires -eq $false) -and ($_.employeetype -ne "admu") -and ($_.emailaddress -ne $null)}

$admin = get-aduser -filter {(enabled -eq $true) -and (employeetype -eq "admu")} -properties extensionattribute14, extensionattribute15, pwdlastset, passwordexpired, passwordneverexpires | 
         select extensionattribute14, extensionattribute15, samaccountname, pwdlastset, passwordexpired, passwordneverexpires, `
                @{l='pwddaysremaining';e={(([datetime]::fromfiletime($_.pwdlastset)).adddays(90) - (get-date)).days}}, `
                @{l='pwdexpireson';e={([datetime]::fromfiletime($_.pwdlastset)).adddays(90)}} | 
         ?{($_.extensionattribute14 -ne $null) -and ($_.extensionattribute15 -ne $null) -and ($_.passwordexpired -ne $true) -and ($_.passwordneverexpires -eq $false) -and (($_.samaccountname -like "da_*") -or ($_.samaccountname -like "it_*"))}

$primary | ?{$_.pwddaysremaining -le 14} |
%{
    $PwdExpiresOn = get-date $_.pwdexpireson -Format G
    $PwdDay = (get-date $_.pwdexpireson).dayofweek 
    $days = ($_.pwddaysremaining).tostring()    
    $fname = (($_.samaccountname).split("."))[0]
    $Wkday = (Get-Date).DayOfWeek
    $HowTo = '"How-To"'
    If($_.pwddaysremaining -le 3)
      {
        switch($days)
          {
            "3" {If($Wkday -eq "Friday"){$SubjectLine = "Your Password Expires On Monday";$SalutatoryLine = "Your password will expire in $days days."}
                                    Else{$SubjectLine = "Your Password Expires in $days Days.";$SalutatoryLine = "Your password will expire in $days days."}}
            "2" {If($Wkday -eq "Friday"){$SubjectLine = "Your Password Expires Before Monday";$SalutatoryLine = "Your password will expire in $days days."}
                                    Else{$SubjectLine = "Your Password Expires in $days Days";$SalutatoryLine = "Your password will expire in $days days."}}
            "1" {If($Wkday -eq "Friday"){$SubjectLine = "Your Password Expires Before Monday";$SalutatoryLine = "Your password will expire tomorrow."}
                                    Else{$SubjectLine = "Your Password Expires Tomorrow";$SalutatoryLine = "Your password will expire tomorrow."}}
            "0" {$SubjectLine = "Your Password Expires Today";$SalutatoryLine = "Your password will expire today.  `
                                 We highly recommend changing your password now to avoid service interruption."}
          }
      }        
      Else{$SubjectLine = "Your Password Expires in $days Days.";$SalutatoryLine = "Your password will expire in $days days."}      
     
    $MailMessage = New-Object Net.Mail.MailMessage #Required
    $MailMessage.To.add($_.EMailAddress) #Required
    $MailMessage.From = "support@company.com" #Required
    $MailMessage.Subject = $SubjectLine 
    $MailMessage.IsBodyHtml = $True
    $MailMessage.Body = "
    <html>
        <table cellpadding='20'  style='border: thin solid black;max-width: 600px;'>
            <tr>
                <td>
                    <center><img width=80 height=80 src='url goes here'</img></center>
                    <font face='verdana'>
                        <p align='center' style='margin-top: 10px;font-size: 20px;color:003366'>
                            <b>Password Expiry Notification</b>
                        </p>
                        <hr color=D8D8D8>
                        <p>
                            Dear $fname,<br>
                            <br>
                            $SalutatoryLine  This password is used for your email and to access corporate 
                            systems. Please read below or <b><a href='url goes here' style='text-decoration:none'>watch a brief video</b></a> covering new instructions to reset your password.<br>
                        <p>              
                            <b>New Instructions:</b>
                            <OL>
                                <LI>Go to the <a href='url goes here'>Company Access</a> website(<a href='url goes here' style='text-decoration:none'>access.company.com</a>).
                                <LI>Enter your firstname.lastname as username, current password
                                <LI>Select and enter the three security questions.
                                <LI>Install the Webpass when it pops-up.
                                <LI>Click Account (bottom of screen) > Click Authentication tile > Click Change Password.
                            </OL>
                                      
                        
                        <p>
                            Thank you,<br>
                            IT Support<br>
                            <a href='url goes here' style='text-decoration:none'>support.company.com</a><br>
                            <a href='mailto:support@company.com?subject=Password%20Expiry%20Notification%20Question' style='text-decoration:none'>support@hhmlp.com</a><br>
                            <a href='tel:717-412-5510' style='text-decoration:none'>717-412-5510</a><br>
                        </p>
                        <p>
                            <b>
                                <center><a href='bitsandbytes.company.com' style='font-size: 11px'>Watch $HowTo VIDEOS on other topics at the IT website</a></center>
                            </b>

                        </p>
                    </font>
                </td>
            </tr>
        </table>
    </html>" #Required

    $SmtpClient = New-Object Net.Mail.SmtpClient("smtp-relay.gmail.com")
    $SmtpClient.Send($MailMessage)
  
}

$admin | ?{$_.pwddaysremaining -le 10} |
%{
    $PwdExpiresOn = get-date $_.pwdexpireson -Format G
    $PwdDay = (get-date $_.pwdexpireson).dayofweek 
    $days = ($_.pwddaysremaining).tostring()    
    $admname = $_.samaccountname
    $admfname = $_.extensionattribute14    
    If($_.pwddaysremaining -eq 10){$SubjectLine = "Your $admname Password Expires in 10 Days!";$SalutatoryLine = "Your $admname password will expire in 10 days.  Please change it soon."}
      ElseIf($_.pwddaysremaining -le 5){
        switch($days){
                       "5" {$SubjectLine = "Your $admname Password Expires in $days Days!";$MessageLine = "Your $admname password will expire in $days days.  Please change it soon."}
                       "4" {$SubjectLine = "Your $admname Password Expires in $days Days!";$MessageLine = "Your $admname password will expire in $days days.  Please change it soon."}
                       "3" {$SubjectLine = "Your $admname Password Expires in $days Days!";$MessageLine = "Your $admname password will expire in $days days.  Please change it soon."}
                       "2" {$SubjectLine = "Your $admname Password Expires the Day After Tomorrow!";$MessageLine = "Your $admname password will expire in $days days.  Please change it soon."}
                       "1" {$SubjectLine = "Your $admname Password Expires Tomorrow!";$MessageLine = "Your $admname password will expire tomorrow.  Please change it soon."}
                       "0" {$SubjectLine = "Your $admname Password Expires TODAY!";$MessageLine = "Your $admname password will expire TODAY.  Please change it now."}}}
           
    $MailMessage = New-Object Net.Mail.MailMessage #Required
    $MailMessage.To.add($_.extensionattribute15) #Required
    $MailMessage.From = "noreply@company.com" #Required
    $MailMessage.Subject = $SubjectLine 
    $MailMessage.IsBodyHtml = $True
    $MailMessage.Body = "
    <html>
        <table cellpadding='20'  style='border: thin solid black;max-width: 600px;'>
            <tr>
                <td>
                    <center><img width=80 height=80 src='url goes here'</img></center>
                    <font face='verdana'>
                        <p align='center' style='margin-top: 10px;font-size: 20px;color:003366'>
                            <b>Admin Password Expiry Notification</b>
                        </p>
                        <hr color=D8D8D8>
                        <p>
                            Dear $admfname,<br>
                            <br>
                            $MessageLine  
                        </p>              
                        
                        <p>
                            IT Infrastructure<br>
                            <a href='url goes here' style='text-decoration:none'>hhmlp.service-now.com</a><br>
                        </p>
                    </font>
                </td>
            </tr>
        </table>
    </html>" #Required

    $SmtpClient = New-Object Net.Mail.SmtpClient("smtp-relay.gmail.com")
    $SmtpClient.Send($MailMessage)
  
}

Neally · 2016-10-27T16:10:26.000Z

TL;DR, sorry.

itprotoday.com

ITPro Today: IT News, How-Tos, Trends, Case Studies, Career Tips, More

IT Pro Today Homepage

mattmcnabb · 2016-10-27T16:12:51.000Z

TLDR

For one, you can get rid of the Net.Mail.SMTPClient calls and just use Send-MailMessage.

Also, it looks like you have a hard-coded value of 90 days for the expiration interval. What will happen if you end up changing this policy next year and forget to update the script? You could use Get-ADDefaultDomainPasswordPolicy instead to return the actual policy value for the interval.

jackgreene2 · 2016-10-27T16:16:32.000Z

Well, you should read. That’s where the pertinent info is, no? Kind of makes replies ill-informed when you don’t read. I appreciate the link nonetheless. But the heart of the question is not how to create and trap errors, but what errors would you trap in this implementation.

jackgreene2 · 2016-10-27T16:19:46.000Z

Thanks matt. Great info. On the send-mail message, that was my first attempt. However, I couldn’t get it to work correctly with an imbedded image in the HTML body in the testing implementation. Went with what worked then, and didn’t change the bulk of it for the new message body. Good call on the get-adddefaultdomainpasswordpolicy.

Neally · 2016-10-27T16:27:16.000Z

nibble:

Well, you should read. That’s where the pertinent info is, no? Kind of makes replies ill-informed when you don’t read. I appreciate the link nonetheless. But the heart of the question is not how to create and trap errors, but what errors would you trap in this implementation.

Don’t post massive scripts. We’re all volunteers and we don’t have time to read all that,
nor will we copy, paste, and run it. Post an excerpt, and clearly state what you’re having
problems with

PLEASE READ BEFORE POSTING! Read if you're new to the PowerShell forum! Programming & Development

Hi, and welcome to the PowerShell forum! Don’t apologize for being a “noob” or “newbie” or “n00b.” There’s just no need – nobody will think you’re stupid, and the forums are all about asking questions. Just ask! Use a descriptive subject. Don’t say “Need help” or “PowerShell Help”, actually summarize what the problem is. It helps the rest of us keep track of which problem is which. Don’t post massive scripts. We’re all volunteers and we don’t have time to read all that, nor will we copy…

You want feedback about your script and recommendation though that thing is rather long. If some people have time to go through and give you feedback that’s super, but it should not be an expectation? ¯_(ツ)_/¯

mattmcnabb · 2016-10-27T16:33:18.000Z

If I get a moment later, I’ll post a version of the script I’ve been using for a couple years now. It grabs all the users who are expiring soon and calculates how many days left until expiration and sends them a message. Then it collects all that data into an html report and sends it to me and a few others on my team. This admin report includes those about to expire and those already expired.

jackgreene2 · 2016-10-27T16:42:57.000Z

Hey Neally, I think we got off on the wrong foot on this topic. I understand all of your points, and they are valid. I want you to understand that my expectation is that if you don’t have time to actually read the question(nevermind the code, you failed at reading the question), then you don’t have time to reply. As for posting a massive script… 163 lines is massive? Hardly. I bet i can go thru your posts and find at least one example of something like this as well. But more importantly, this post is a discussion, not a specific question seeking a specific answer. As such, the code in its entirety is provided as reference for a general discussion of a business concept.

DoctorDNS · 2016-10-27T16:49:47.000Z

tl;dr

Please - 145 lines of code is on the large side.

As to password expiry notices - I thought Windows advised you about soon to change the password. The time used to be 14 days, but IIRC, irt was reduced in Win7 to 5 days. Is this not adqequte?

Second, you should use ISE Steroids and get rid of all the aliases. Makes the code much, much, much easier to read. And while you are at it, make the variable names more meaningful - what is $primary?

I notice you pipe the variable $primary - using foreach might be a better way to go.

As for error handling - virtually any cmdlet you can run can generate an exception! Try/Catch to the rescue./

Can you refactor the code, and create some sub-functions?

psophos · 2016-10-27T17:07:20.000Z

I’ll echo Thomas’ point on aliases. Using ? and % makes rather it hard to read. And that’ something that will bite you on the bum later when you come back to this. In a script user the full cmdlet names like Where-Object and Foreach-Object.

There is also duplication between standard users and admin users. Is that duplication really necessary? Duplicated code can lead to errors.

Complexity. Do you need those 2 switch statements (which are different from each other) to perform that logic for the meail subject and body statement? Especially as you’ll be warning people every day for 14 (or 10) days anyway.

jackgreene2 · 2016-10-27T17:17:13.000Z

Thanks TFL

The windows basic notification is not sufficient. At a minimum, we require an email notification. Other factors also necessitate something more extensive. Point taken on aliases/shorthand and variable names. On the error handling, it’s not really a question of how, but of why…in this particular circumstance. I could write try/catch for contacting a DC, or for properly constructing the $fname variable. But ultimately these seem like error-handling just for the sake of having it. Something along the line of an admin report, as mentioned by Matt, seems more appropriate. As for the functions, the days remaining calculation was pulled from a function I previously wrote. This script was produced from various other scripts specifically to run as a scheduled task, so I removed the function constructs.

jackgreene2 · 2016-10-27T17:30:03.000Z

M Boyle,

I struggled in deciding to duplicate the code. It isn’t a direct duplication, hence the dilemma. In the end, I decided to semi-duplicate because i use different AD attributes for admin and since the message is drastically different. Admittedly, there may be a more concise way to achieve the same result. On the switches, for non-admin accounts we opted to provide the information several times…aiming at the least common denominator.

psophos · 2016-10-27T17:41:31.000Z

The simplest way will be to treat all users the same. Yes your admins might be insulted that they get the same generic mail telling them how to do something that they already know how to do. But so what?

14 days and the same email body would probably cut 30 - 40% of the code out.

There’s aiming for the lowest common denominator and treating adults like children

Keep it simple. Simpler solution are more robust and usually have less errors. Or maybe more obvious ones.

psophos · 2016-10-27T17:50:07.000Z

There’s a reasonable script here: https://gallery.technet.microsoft.com/Password-Expiry-Email-177c3e27 Archived MSDN and TechNet Blogs | Microsoft Learn

It handles empty mails addresses, adds a logging option, handles Fine-Grained Password Policies (if used), has a test mode and is a nice clean base for changes you might want to make.

Mind you, I don’t understand why he didn’t use $true and $false for the logging and testing parts. But it’s still an excellent base.

For error handling in general (either script) I would be looking at a try/catch around the Get-ADUser and the Send Mail parts. Those are the areas likely to throw errors and you will want to capture those errors to a log file so you can troubleshoot failures.

A wrinkle is that some errors don’t cause the try/catch part to trigger so have a look in the help for the cmdlet and see if it supports an -ErrorAction parameter. If yes then set that parameter to ‘Stop’. Get-ADUser does,

mattmcnabb · 2016-10-27T23:04:49.000Z

Here’s an example of what we’ve been doing for a while now. This is one of my earlier scripts, but I haven’t really touched it much and it’s still working great for us:

gist.github.com

https://gist.github.com/mattmcnabb/200cd8caf040d9492e71420f3d84dd6f

PasswordExpiration.ps1

<#
        .DESCRIPTION
        Finds all users in Active Directory with passwords close to expiring
        and notifies them via email. Also creates and sends a report that includes all 
        expired and expiring passwords.
#>
#Requires -Version 3.0
#Requires -Module ActiveDirectory

param

This file has been truncated. show original

And I definitely agree with @thomaslee that the built-in Windows notifications should be enough, but they’re not always and it can’t hurt to send out regular reminders of password reset process. This has significantly reduced our number of helpdesk calls for password resets in the past few years. It also helps us keep a pulse on how our users are doing and which user segments are ignoring these reminders (or never checking their email).

jitensh · 2016-10-28T04:24:06.000Z

I use this simplest one not thinking about setting it any different way, what is your plan?

$ExpireDays = 10 #define days here
Import-Module ActiveDirectory
$AllUsers = get-aduser -filter * -properties * |where {$_.Enabled -eq "True"} | where { $_.PasswordNeverExpires -eq $false } | where { $_.passwordexpired -eq $false }
foreach ($User in $AllUsers)
{
  $Name = (Get-ADUser $User | foreach { $_.Name})
  $Email = $User.emailaddress
  $PasswdSetDate = (get-aduser $User -properties * | foreach { $_.PasswordLastSet })
  $MaxPasswdAge = (Get-ADDefaultDomainPasswordPolicy).MaxPasswordAge
  $ExpireDate = $PasswdSetDate + $MaxPasswdAge
  $Today = (get-date)
  $DaysToExpire = (New-TimeSpan -Start $Today -End $ExpireDate).Days
  $EmailSubject="Password Expiry Notice - your password expires in $DaystoExpire days"
  $Message="
  Dear $Name,
  <p> Your Password expires in $DaysToExpire days.<br />
  To change your password, Press CTRL+ ALT + DEL together and change Password. <br />
  
  <p><B>Passwords must contain:</B> </p>

a minimum of 1 lower case letter [a-z] and </br />
a minimum of 1 upper case letter [A-Z] and </br />
a minimum of 1 numeric character [0-9] and </br />
a minimum of 1 special character: ~!@#$%^&*()_+={}[]|\;:<>/? </br />

<p>If you do not update your password in $DaysToExpire days, you will not be able to log in, so please make sure you update your password. <br /></p>

<p>If you need any help, contact us via email: helpdesk@example.org, by internal phone 1337. <br /></p>

Sincerely, <br />
  The IT Department. <br />
  </p>"
  
    

# smtp server
$emailSmtpServer = "smtp"
$emailSmtpServerPort = "587"
$emailSmtpUser = "users"
$emailSmtpPass = "P@ssw0rd"
# recipient 
$emailFrom = "doman"
$emailTo = $Email
# message
$emailMessage = New-Object System.Net.Mail.MailMessage( $emailFrom , $emailTo )
$emailMessage.Subject = $EmailSubject
$emailMessage.IsBodyHtml = $true
$emailMessage.Body = $Message
#client 
$SMTPClient = New-Object System.Net.Mail.SmtpClient( $emailSmtpServer , $emailSmtpServerPort )
$SMTPClient.EnableSsl = $False #if SSL is enable set as True
$SMTPClient.Credentials = New-Object System.Net.NetworkCredential( $emailSmtpUser , $emailSmtpPass );
$SMTPClient.Send( $emailMessage )
#>

  } 
#relay 
send-mailmessage -to $emailto -from $emailfrom -subject $Emailsubject -body $message -smtp $emailsmtpserver -BodyAsHtml

DoctorDNS · 2016-10-28T08:16:43.000Z

nibble:

Thanks TFL

The windows basic notification is not sufficient. At a minimum, we require an email notification. Other factors also necessitate something more extensive. Point taken on aliases/shorthand and variable names. On the error handling, it’s not really a question of how, but of why…in this particular circumstance. I could write try/catch for contacting a DC, or for properly constructing the $fname variable. But ultimately these seem like error-handling just for the sake of having it. Something along the line of an admin report, as mentioned by Matt, seems more appropriate. As for the functions, the days remaining calculation was pulled from a function I previously wrote. This script was produced from various other scripts specifically to run as a scheduled task, so I removed the function constructs.

Thanks for the response.

To some degree, you are trying to use technology to solve a people problem. The problem is that people don’t change their passwords even when they are warned. Adding another layer of complexity may be a bit of a waste of time. If you make it harder to get passwords reset, you can raise the awareness of that notice. If people, say, have to login to get paid, and can’t because their passwords have expired - trust me, loss of a pay cheque for a day or two will definitely get their attention! You need to change people’s behaviour. But if this works for you then go fo it!

Another idea, can you give them a tool to change the password? If so, make the tool add a scheduled task into their system that sends them a mail at the appropriate (14-day) notice period?

Regarding error handling - I like Mrs Murphy’s comment on Murphy’s law: ‘Murphy was an optimist’. If anything can go wrong in a script, it will! One way to deal with this is to leave the script as it is, and wait for it to break. When it does, THEN add Try/Catch around the relevant code - in other words, code error handling where you get errors not everywhere. Pragmatism rules.

jackgreene2 · 2016-10-28T11:28:10.000Z

I agree with your assessment TFL. In my position, I do have quite a bit of latitude in our systems, but relatively none over our culture; it’s a battle I valiantly fight at every opportunity. As for the error handling…i kind of figured i would have heard something by now. No harm in continuing to wait.

Thanks for the link Matt. I particularly like the reporting.

mattmcnabb · 2016-10-28T13:00:24.000Z

nibble:

I agree with your assessment TFL. In my position, I do have quite a bit of latitude in our systems, but relatively none over our culture; it’s a battle I valiantly fight at every opportunity. As for the error handling…i kind of figured i would have heard something by now. No harm in continuing to wait.

Thanks for the link Matt. I particularly like the reporting.

The reporting piece has been invaluable to us in the culture war that @thomaslee mentioned. When we see someone enter the “Password Expired” list, we can get an idea from the report of who they are and forward the information to their manager if necessary. If you are trying to change culture, targeted user education is much more effective than the blanket variety.

Another good use for this is to help clean up stale accounts. When we see someone’s password expire, we can investigate and make sure they are active staff. There have been a few times where an employee had left and we hadn’t closed the loop on removing access for some reason or another. This is an extra safeguard that helps us clean up those stale accounts.

psophos · 2016-10-28T13:35:50.000Z

Another good use for this is to help clean up stale accounts. When we see someone’s password expire, we can investigate and make sure they are active staff. There have been a few times where an employee had left and we hadn’t closed the loop on removing access for some reason or another. This is an extra safeguard that helps us clean up those stale accounts.

Rather good idea that. Especially if you have to deal with audits.