Re: Password expirey

Passwords expire based on the pwdlastset time being older than the current date minus the domain password policy. So yes, if you get all of the passwords expired and set in time, when you turn on the policy, no one will expire until their password age hits the date.


It can be done with simple command line tools... Such as (all one line)

adfind -b OU_DN -f "&(objectcategory=person)(objectclass=user)" -dsq |admod pwdlastset::0


You can also do it with a dsquery | dsmod combination.

joe

--
Joe Richards Microsoft MVP Windows Server Directory Services
Author of O'Reilly Active Directory Third Edition
www.joeware.net


---O'Reilly Active Directory Third Edition now available---

http://www.joeware.net/win/ad3e.htm


Brendon B wrote:
Thanks for the input Richard.

So you are saying that as long as the passwords have been forced to expire previously, that when the we turn on the policy it won't force them to change it again provided it was expired within the policy eg 60 days.

Can you provide me with a bit more info on expiring the accounts within a specific OU? Can this be done using a Group policy or must it be done via a script?

Thanks again

Regards
Brendon
.

Relevant Pages

  • Re: Group Policys and Passwords
    ... Either you have two separate domains or you are implementing it at a local ... There is only one pw policy per domain.... ... it's not a great idea to have all passwords expire the same day. ...
    (microsoft.public.windows.server.general)
  • Re: Password Renewal
    ... > or you can expire the accounts in batches ahead of time. ... > Joe Richards Microsoft MVP Windows Server Directory Services ... >> The password policy has previously been for passwords not to expire. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Password Renewal
    ... When you set this policy it applies to the next time the users change their ... > The password policy has previously been for passwords not to expire. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Password Renewal
    ... You can either slowly bring your policy down to 90 days from say 1000 days or you can expire the accounts in batches ahead of time. ... The password policy has previously been for passwords not to expire. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Locking down database accounts
    ... Personally it sounds to me that your company has established a policy and is ... But bottom line if you have to use SQL Server logins and passwords, ... Whether it's an encrypted flat file or an encrypted XML file, ...
    (microsoft.public.sqlserver.security)