Powershell script to check domain password policy and user password status.

One of our domain users tried to change his password and he got the error message:
"Unable to update the password. The value provided for the new password does not meet the length, complexity, or history requirements of the domain."

I tried to find the reason. Many people mentioned that the problem might be the setting of "Min password age", then I found this Power Shell scipt which can give me the setting of password policy and the last time user changed his password.

This is the original link:
http://www.blackops.ca/cms/blog/?p=295

This is the scipt code:
===========================

cls
$searcher = New-Object System.DirectoryServices.DirectorySearcher([ADSI]'')
While (!$result){
  $UserName = Read-Host 'Username to check : '
  if (!$UserName){
    Write-Host "No Username Entered"exit
  }
  $searcher.Filter = "(&(objectClass=User)(samAccountName=" + $username + "))"
  $result = $searcher.Findone()
}
# get domain password policy (max pw age)
$D = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
$Domain = [ADSI]"LDAP://$D"
$MPA = $Domain.maxPwdAge.Value
$MinPA = $Domain.minPwdAge.Value
# Convert to Int64 ticks (100-nanosecond intervals).
$lngMaxPwdAge = $Domain.ConvertLargeIntegerToInt64($MPA)
$lngMinPwdAge = $Domain.ConvertLargeIntegerToInt64($MinPA)
$MinPwdLength = $Domain.minPwdLength
$PwdHistory = $Domain.pwdHistoryLength
# Convert to days.
$MaxPwdAge = -$lngMaxPwdAge/(600000000 * 1440)
$MinPwdAge = -$lngMinPwdAge/(600000000 * 1440)
$lngPwdLastSet =$result.Properties.pwdlastset
$pwdLastSet = [datetime]::FromFileTime($lngPwdLastSet[0])
Write-Host $result.Path
Write-Host $result.Properties.cn " " $result.Properties.userprincipalname
Write-Host "Password Last Set : " $pwdLastSet
Write-Host "Max Password Age : " $MaxPwdAge
Write-Host "Min Password Age : " $MinPwdAge
Write-Host "Password History : " $PwdHistory
Write-Host "Min Password Length : " $MinPwdLength
if ($pwdLastSet -ge (Get-Date).AddDays(-$MinPwdAge)){
  Write-Host -ForegroundColor Red "Password can not be changed - Min Age"
}
if ($pwdLastSet -ge (Get-Date).AddDays($MaxPwdAge)){
  Write-Host -ForegroundColor Red "Password Expired"
}

========== end of scipt =====================

Active Directory Service Interfaces

Active Directory Service Interfaces (ADSI) is a set of COM interfaces used to access the features of directory services from different network providers. ADSI is used in a distributed computing environment to present a single set of directory service interfaces for managing network resources. Administrators and developers can use ADSI services to enumerate and manage the resources in a directory service, no matter which network environment contains the resource.

ADSI enables common administrative tasks, such as adding new users, managing printers, and locating resources in a distributed computing environment.
http://msdn.microsoft.com/en-us/library/windows/desktop/aa772170(v=vs.85).aspx

Active Directory Service Interfaces Reference
http://msdn.microsoft.com/en-us/library/windows/desktop/aa772218(v=vs.85).aspx

=============================================================

We can use System Providers in ADSI to create object and remotely manage Active Directory.  ADSI includes the service providers listed in this page:
http://msdn.microsoft.com/en-us/library/windows/desktop/aa772235(v=vs.85).aspx


Example:

For ADSI WinNT Provider

We can use Set objUser = GetObject("WinNT://"& strDomain &"/" & strUser) to create an IADsUser object and access the IADsUser object properties.

This page has all the objects of WINNT provider
http://msdn.microsoft.com/en-us/library/windows/desktop/aa772211(v=vs.85).aspx

IADsUser is one of the WINNT objects. This page has the interface of IADsUser, including methods and properties.
http://msdn.microsoft.com/en-us/library/windows/desktop/aa746340(v=vs.85).aspx

This method can set user password: objUser.SetPassword strPassword

Remotely access Exchange 2010 with PowerShell Script

Remotely check Exchange 2010 mailbox size

'Run these two commands in PowerShell first to remotely connect to exchange server from local PowerShell

$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri http://(server name)/PowerShell/ -Authentication Kerberos

Import-PSSession $Session


'Do query

'Get one user mailbox size, can also get subfolder size by changing -folder value
Get-MailboxStatistics -Identity UserName | select -Property TotalItemSize


'This can also give the mailbox size
Get-MailboxFolderStatistics -Identity UserName -folderscope all | select -Property FolderAndSubfolderSize -first 1


'Get mailboxe size for all mailboxes
Get-MailboxStatistics -server myExchangeServerName | select Displayname,TotalItemSize | Sort-Object Displayname


'Export result to Excel file
Get-MailboxStatistics -server myExchangeServerName | select Displayname,TotalItemSize | Sort-Object Displayname | Export-CSV c:\temp\inboxsizes.csv


'View all quotas assigned to a mailbox
Get-Mailbox UserName | Format-List *Quota


'export result to Excel file
Get-MailboxStatistics -server mfl67207 | select Displayname,TotalItemSize | Sort-Object Displayname | Export-CSV c:\temp\inboxsizes.csv


'View all quotas assigned to a mailbox
Get-Mailbox <Identity> | Format-List *Quota


'Exporting Message Tracking Logs to .CSV
Get-MessageTrackingLog -Server <Server name> -Start "01/01/13 00:00:00" -End "12/12/13 23:59:59" -Recipient "TheMole@BadGuyCompany.com" -Resultsize unlimited| select sender, recipient, timestamp, messagesubject, totalbytes | export-csv c:\temp\messlog.csv


'Check inbox rule
Get-InboxRule –Mailbox <username> | fl > \temp\outlookClientRules.txt


'Disable a users Outlook Rules
Disable-Inboxrule –Mailbox <Bob Smith> -Identity “<TheOutlookRule>”




'To delete a specific users Outlook Rules
Remove-Inboxrule –Mailbox <Bob Smith> -Identity “<TheOutlookRule>”


'This is a link for Powershell command Get-mailboxstatistics
http://technet.microsoft.com/en-us/library/bb124612(v=exchg.150).aspx

'I found the above command from this page:
http://help.outlook.com/en-us/140/Gg576861.aspx


'This is Microsoft page about Powershell cmdlet
https://technet.microsoft.com/en-us/library/bb123981(v=exchg.160).aspx

VBScript to manage user accounts

VBscript can use WMI object to access properties of Domain and users.

===============================================
Unlock User Account
-------------------------------------------------------------------------------
This is a sample code to unlock user account when user put wrong password too many times and his account has been locked.

Code 1:

Dim oUser
Set oUser = GetObject("WinNT://DomainName/UserName")
WScript.Echo "user name:" & oUser.Name&vbcr&"Is account locked:" & oUser.IsAccountLocked
oUser.IsAccountLocked = 0
WScript.Echo "user name:" & oUser.Name&vbcr&"Is account locked:" & oUser.IsAccountLocked

A better pice of code can be found here:
http://community.spiceworks.com/scripts/show/54-unlock-user-account

Code 2:

Dim oUser
LDAPpath = ' to find LDAP distinguished name (DN) in AD
Set objUser = GetObject("LDAP://" & LDAPpath)

objUser.IsAccountLocked = False
oUser.SetInfo

===================================================
Reset User Account Password
-------------------------------------------------------------------------------
This is a sample code to reset user account password.

Dim oUser
LDAPpath = ' to find LDAP distinguished name (DN) in AD
Set objUser = GetObject("LDAP://" & LDAPpath)

strPassword = InputBox("Please put a new password.","Reset User password")
oUser.SetPassword strPassword
oUser.SetInfo

===================================================
Force User to Change Account Password at The First Login
-------------------------------------------------------------------------------
This is a sample code to reset user account password.

Dim oUser
LDAPpath = ' to find LDAP distinguished name (DN) in AD
Set objUser = GetObject("LDAP://" & LDAPpath)

objUser.PwdLastSet = 0
oUser.SetInfo
===================================================

Find LDAP distinguished name (DN) in AD
-------------------------------------------------------------------------------

I found this script code on Microsoft website.

http://gallery.technet.microsoft.com/scriptcenter/dee78632-f6d0-4be3-920f-27165fa60767

'**************************************************************
'=  Created By: Devin H.
'=  Function Name: distinguish           Date: 10/19/2005           Version:1.1
'=  
'=  Variables: strObject, strType  
'= 
'=  This function will return the distinguished name of an object stored in 
'=  Active Directory.  This is useful when you don't know exactly where an 
'=  object is located or want to move something.
'=  
'=  Usage: Wscript.Echo distinguish("DevinH","user") 
'=  Returns: cn=DevinH,ou=MyUsers,dc=ScriptCentric,dc=com       
'=
'**************************************************************
Function distinguish(strObject, strType)
    Select case strType
        Case lcase("computer")
            strobject = strObject & "$"
        Case lcase("user")
            'Good
        Case lcase("group")
            'Good
        Case else
            Wscript.Echo "Their is an error in the script"
    End Select
    ' Determine DNS domain name (this could be hard coded).
    Set objRootDSE = getObject("LDAP://RootDSE")
    strDNSDomain = objRootDSE.get("defaultNamingContext")
    
    Const ADS_SCOPE_SUBTREE = 2
    
    Set objConnection = createObject("ADODB.Connection")
    Set objCommand = createObject("ADODB.Command")
    objConnection.Provider = "ADsDSOObject"
    objConnection.Open "Active Directory Provider"
    
    Set objCOmmand.ActiveConnection = objConnection
    objCommand.CommandText = _
    "Select distinguishedname, Name, Location from 'LDAP://" & strDNSDomain & _
    "' Where objectClass='" & strType & "' and samaccountname='" & strobject & "'"
    objCommand.Properties("Page Size") = 1000
    objCommand.Properties("Searchscope") = ADS_SCOPE_SUBTREE 
    Set objRecordSet = objCommand.execute
    objRecordSet.MoveFirst
    
    Do Until objRecordSet.EOF
       distinguish = objRecordSet.Fields("distinguishedname")
       objRecordSet.MoveNext
    Loop
End Function

===================================================

This is my code with all these together

'*********** code begin*****************

On Error Resume Next
strUser = InputBox("Please enter a user name.","user_password")
If strUser = vbNullString then
   MsgBox "Either Cancel was selected or you did not enter a user name.", 16, "User Unlock"
   WScript.Quit
End If
strDomain = "myDOMAIN"
dim LDAPpath
Const STRING_OBJ_TYPE = "user"
LDAPpath = distinguish(strUser,STRING_OBJ_TYPE)
Set objUser = GetObject("LDAP://" & LDAPpath)
If Err.Number <> 0 Then
   MsgBox (strUser) & " isn't a valid user name!", 48,"Reset User password"
   Wscript.Quit
End If
Err.Clear
On Error Resume Next
   style = vbYesNo + vbDefaultButton2
    
   'set new password  
   WantNewPwd = MsgBox("Do you want to reset user's password?", style,"user_password")
   If WantNewPwd = vbYes Then
       strPassword = InputBox("Please put a new password.","Reset User password")
       objUser.SetPassword strPassword
   End If
  
   'force user to change the password at the first time login
   forceNewPsd = MsgBox("Do you want user to change password at first login?", style,"user_password")
   If forceNewPsd = vbYes Then
       objUser.PwdLastSet = 0
   End If
   UnlockAccount = MsgBox("Do you want to unlock user account?", style,"user_password")
   If UnlockAccount = vbYes Then
       objUser.IsAccountLocked = False
   End If 
  
   objUser.SetInfo
If Err.Number <> 0 Then
   MsgBox("An error has occurred. " & Err.Number)
   Err.Clear
Else
   MsgBox "The Password/Account Has Been Changed For " & UCase(strDomain) & "\" & UCase(strUser)
End If
Wscript.Quit

'=====================================================
'=  Created By: Devin H.
'=  Function Name: distinguish           Date: 10/19/2005           Version:1.1
'=  
'=  Variables: strObject, strType  
'= 
'=  This function will return the distinguished name of an object stored in 
'=  Active Directory.  This is useful when you don't know exactly where an 
'=  object is located or want to move something.
'=  
'=  Usage: Wscript.Echo distinguish("DevinH","user") 
'=  Returns: cn=DevinH,ou=MyUsers,dc=ScriptCentric,dc=com       
'======================================================

Function distinguish(strObject, strType)
    Select case strType
        Case lcase("computer")
            strobject = strObject & "$"
        Case lcase("user")
            'Good
        Case lcase("group")
            'Good
        Case else
            Wscript.Echo "Their is an error in the script"
    End Select
    ' Determine DNS domain name (this could be hard coded).
    Set objRootDSE = getObject("LDAP://RootDSE")
    strDNSDomain = objRootDSE.get("defaultNamingContext")
    
    Const ADS_SCOPE_SUBTREE = 2
    
    Set objConnection = createObject("ADODB.Connection")
    Set objCommand = createObject("ADODB.Command")
    objConnection.Provider = "ADsDSOObject"
    objConnection.Open "Active Directory Provider"
    
    Set objCOmmand.ActiveConnection = objConnection
    objCommand.CommandText = _
    "Select distinguishedname, Name, Location from 'LDAP://" & strDNSDomain & _
    "' Where objectClass='" & strType & "' and samaccountname='" & strobject & "'"
    objCommand.Properties("Page Size") = 1000
    objCommand.Properties("Searchscope") = ADS_SCOPE_SUBTREE 
    Set objRecordSet = objCommand.execute
    objRecordSet.MoveFirst
    
    Do Until objRecordSet.EOF
       distinguish = objRecordSet.Fields("distinguishedname")
       objRecordSet.MoveNext
    Loop
End Function

'***************end of code*************