{"id":4684,"date":"2023-02-12T18:59:00","date_gmt":"2023-02-13T02:59:00","guid":{"rendered":"https:\/\/tungle.ca\/?p=4684"},"modified":"2023-03-13T17:32:24","modified_gmt":"2023-03-14T01:32:24","slug":"send-email-notification-before-ad-password-expiration","status":"publish","type":"post","link":"https:\/\/tungle.ca\/?p=4684","title":{"rendered":"Send email notification before Active Directory password expired"},"content":{"rendered":"\n

I am very glad to see there are more than 50,000 views in my blog when starting on counting “total visits” in my blog 7 months ago. Below are the top views from my blog.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Today, I want to share a small IT PowerShell script which is used to send notification to domain users before their password will be expired.<\/p>\n\n\n\n

According to MS link (https:\/\/learn.microsoft.com\/en-us\/windows\/win32\/adschema\/a-msds-userpasswordexpirytimecomputed), ms-DS-User-Password-Expiry-Time-Computed attribute is used to contain user password’s expire time in Active Directory. So, using the PowerShell code below to query this value in AD.<\/p>\n\n\n\n

Get-ADUser -filter {Enabled -eq $True -and PasswordNeverExpires -eq $False} -Properties DisplayName, EmailAddress, msDS-UserPasswordExpiryTimeComputed<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
However, the value “133214896056482435” does not have any meaning, so we use [datetime]::FromFileTime($_.”msDS-UserPasswordExpiryTimeComputed”) to convert this value from FromFileTime to DateTime format in PowerShell.<\/p>\n\n\n\n
# Query AD user \n$Users = Get-ADUser -filter {Enabled -eq $True -and PasswordNeverExpires -eq $False} -Properties DisplayName, EmailAddress, msDS-UserPasswordExpiryTimeComputed | `\nSelect-Object -Property DisplayName,  EmailAddress, @{Name=\"ExpirationDate\";Expression={[datetime]::FromFileTime($_.\"msDS-UserPasswordExpiryTimeComputed\")}} | `\nSort-Object \"ExpirationDate\" \n$users | sort-object ExpirationDate<\/code><\/pre>\n\n\n\n
The PowerShell outputs a list of Domain users corresponding to “Display Name”, “EmailAddress” and “ExpirationDate”.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Next, check if the password will be expired soon (14 days) and send email notification to domain users.<\/p>\n\n\n\n
# Query AD user \n$Users = Get-ADUser -filter {Enabled -eq $True -and PasswordNeverExpires -eq $False} -Properties DisplayName, EmailAddress, msDS-UserPasswordExpiryTimeComputed | `\nSelect-Object -Property DisplayName,  EmailAddress, @{Name=\"ExpirationDate\";Expression={[datetime]::FromFileTime($_.\"msDS-UserPasswordExpiryTimeComputed\")}} | `\nSort-Object \"ExpirationDate\" \n#$users | sort-object ExpirationDate\n\n# Check if the password will be expired soon and send email notification.\n$UserList = foreach ($User in $users) {\nif ($User.ExpirationDate -le (Get-Date).AddDays(14) -and $User.ExpirationDate -ge (Get-Date))  \n {\n    # Create PSCustomObject to save a list of users whom will have a password expired soon\n    [PSCustomObject]@{\n        Name       = $User.DisplayName\n        EmailAddress = $User.EmailAddress\n        ExpiryDate = $User.ExpirationDate\n        }\n}\n}\n$userlist | sort-object ExpirationDate<\/code><\/pre>\n\n\n\n
PowerShell outputs a list of domain users who have the domain password will be expired soon.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Now, we will write an entire script to send email notification before AD password will be expired. <\/p>\n\n\n\n
Get a password from the console, encrypt it and save into the file C:\\Shared\\admincred.txt<\/p>\n\n\n\n
Read-Host -Prompt \"Enter your tenant password\" -AsSecureString | ConvertFrom-SecureString | Out-File \"C:\\Shared\\admincred.txt\" <\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
cat C:\\Shared\\admincred.txt<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Below is a full PowerShell script to send email notification.<\/p>\n\n\n\n
# PowerShell script that can send email notifications to domain users before their passwords will be expired.\n\n# Query AD user \n$Users = Get-ADUser -filter {Enabled -eq $True -and PasswordNeverExpires -eq $False} -Properties DisplayName, EmailAddress, msDS-UserPasswordExpiryTimeComputed | `\nSelect-Object -Property DisplayName,  EmailAddress, @{Name=\"ExpirationDate\";Expression={[datetime]::FromFileTime($_.\"msDS-UserPasswordExpiryTimeComputed\")}} | `\nSort-Object \"ExpirationDate\" \n\n# Check if the password will be expired soon and send email notification.\n$UserList = foreach ($User in $users) {\nif ($User.ExpirationDate -le (Get-Date).AddDays(14) -and $User.ExpirationDate -ge (Get-Date))  \n {\n    # Create PSCustomObject to save a list of users whom will have a password expired soon\n    [PSCustomObject]@{\n        Name       = $User.DisplayName\n        EmailAddress = $User.EmailAddress\n        ExpiryDate = $User.ExpirationDate\n        }\n    # Send email\n    [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12\n    $SMTP = \"smtp-mail.outlook.com\"\n    $From = \"admin@outlook.com\"\n    $username = \"admin@outlook.com\"\n    #Read-Host -Prompt \"Enter your tenant password\" -AsSecureString | ConvertFrom-SecureString | Out-File \"C:\\Shared\\admincred.txt\" \n    $Pass = Get-Content \"C:\\Shared\\admincred.txt\" | ConvertTo-SecureString\n    $cred = New-Object System.Management.Automation.PSCredential -argumentlist $username, $Pass\n    $Subject = \"Password Expiration Warning\"\n    $Body = \"Dear $($User.DisplayName),\" + \"`n`nYour password will expire in $User.ExpirationDate. Please change your password as soon as possible.\" + \"`n`nRegards,\" + \"`nIT Department\"\n    $EmailBody = \"Hello $($User.DisplayName),\" + \"`n`n\" +\n                 \"This is a reminder that your password will expire in $($User.ExpirationDate).\" + \"`n`n\" +\n                 \"Please take a moment to change your password to ensure continued access to your account.\" + \"`n`n\" +\n                 \"Thank you,\" + \"`n\" +\n                 \"IT Team\"\n\n   # Try to send the email, catch any exceptions, and log them\n    Try {\n   #   Send-MailMessage -From $From -To $User.EmailAddress -Subject $Subject -Body $EmailBody -smtpserver $SMTP -usessl -Credential $cred -Port 587\n      $EmailMessage = @{\n        From = $From\n        To = $User.EmailAddress\n        Subject = $Subject\n        Body = $EmailBody\n        SmtpServer = $SMTP\n        UseSsl = $True\n        Credential = $cred\n        Port = 587\n        }\n      Send-MailMessage @EmailMessage      \n    # Log success\n      Add-Content -Path \"C:\\Shared\\Logs\\EmailSuccess.log\" -Value \"Email sent successfully to $($User.DisplayName) at $($User.EmailAddress) on $(Get-Date) \"\n    }\n    Catch {\n      # Write the error message to the file EmailFailure.log under C:\\Shared\\Logs.\n      Write-Host \"Error sending email to $($User.DisplayName) at $($User.EmailAddress): $_\"\n      Add-Content -Path \"C:\\Shared\\Logs\\EmailFailure.Log\" -Value \"Error sending email to $($User.DisplayName) at $($User.EmailAddress) on $(Get-Date) $_\"\n    }\n}\n}\n$Userlist | sort-object ExpirationDate<\/code><\/pre>\n\n\n\n
Run the script.<\/p>\n\n\n\n
C:\\Users\\Administrator\\passwordnotify.PS1<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Checking the EmailSuccess.log file, the script was successfully sent email notification to AD users before their password will be expired.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
The script sent an email notification to AD users.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Finally, we can add the script into the Task Scheduler to check domain users’ password expiration and send email notification.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Trigger tab.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Actions tab.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Actions Settings:\n\nProgram: %SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe\n\nArguments: -ExecutionPolicy Bypass -File C:\\Shared\\passwordnotify.PS1<\/code><\/pre>\n\n\n\n
The task was running successfully in Task Scheduler history.<\/p>\n\n\n\n
\"\"
Checking logs in the EmailSuccess.log file to confirm the task scheduler was running successfully.<\/figcaption><\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
The email notification was sent to Gmail’s account.<\/p>\n\n\n\n
\"\"<\/figure>\n","protected":false},"excerpt":{"rendered":"
I am very glad to see there are more than 50,000 views in my blog when starting on counting “total visits” in my blog 7 months ago. Below are the top views from my blog. Today, I want to share a small IT PowerShell script which is used to send notification to domain users before […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9,7],"tags":[10,12],"class_list":["post-4684","post","type-post","status-publish","format-standard","hentry","category-microsoft","category-powershell","tag-microsoft","tag-powershell"],"_links":{"self":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/4684","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4684"}],"version-history":[{"count":19,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/4684\/revisions"}],"predecessor-version":[{"id":4783,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/4684\/revisions\/4783"}],"wp:attachment":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4684"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4684"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4684"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}