Password Expiration Email Reminders

Below is a PowerShell script that will email password change reminders to users when their password is about to expire.  It uses built in windows functionality and doesn't require any third party software.  It's fully customizable with the ability to easily set email intervals.

The default email schedule will email users at 30 days, 15 days, 7 days, 5 days, 3 days, 2 days, 1 day and the day of password expiration.  If the user changes their password they will stop receiving email notifications until it becomes time to change their password again.

The script will ignore disabled user accounts and accounts that have the password never expires attribute set.  If the user has an associated email address in active directory it will send the reminder to that email address.  If the user does not have an associated email address an email will be sent to the address specified by the $adminEmail variable.  Thus allowing the admin to be proactive.  The script will also email the $adminEmail if a user's account has expired.  Again, so that the admin can be proactive.  The $adminEmail will receive only one email summary to avoid inbox clutter.  The summary will also show user's that are required to change their passwords but have not done so yet.  There's usually a good reason they're not logging on.  Usually these types of accounts were provision for an employee but that employee never started.

You will need an SMTP server that doesn't require authentication to send out the emails.  You will also need the active directory modules in order to run the script.  Information regarding that can be found here: http://technet.microsoft.com/en-us/library/dd378937(WS.10).aspx

In a nutshell, if you're running the script on a domain controller you should be set.  If you want to run it on a member server then execute the following PowerShell commands:

Import-Module ServerManager

Add-WindowsFeature RSAT-AD-PowerShell

You should create a scheduled task to run the script shortly after midnight each night.  Before using it, be sure to set the five configuration variables in the Configurable Settings section at the top of the script.   

Note: The script is just using the default domain password policy but if you're using the AD DS Fine-Grained Password Policies you should be able to modify the script fairly easily.  You'll just have to invoke the Get-ADUserResultantPasswordPolicy commandlet while iterating through the user objects.  Also note that all time is done with GMT and time zones are not taken into account.  This shouldn't be an issue unless your enterprise spans the globe.  If you're enterprise only spans a few contiguous time zones, have the script run at midnight in the time zone that's closest to GMT.

You can download the script here or see below.

CODE:

#Create a nightly scheduled task that runs shortly after midnight and execute this script to generate password expiration email reminders

Import-Module ActiveDirectory

#----- Configurable Settings ------------------------------------------------------------------------------------------------------------------------

# Set the $warningInterval array to change when password expiration email reminders go out.
# The default below will email users at 30 days, 15 days, 7 days, 5 days, 3 days, 2 days, 1 day and the day of.
$warningIntervals = 30,15,7,5,3,2,1,0


# Set the $adminEmail to the email address that will receive password expiration reminders if the user does not have an associated mail address in AD
$adminEmail = 'admin@domain.com'


# Set the $fromEmail to the email address that will be used to send out password expiration reminders
$fromEmail = 'from@domain.com'


# Set the SMTP server used for sending out password expiration reminders, no authentication is used
$smtpServer = "smtp.domain.com"


# If $True, a summary will always be sent to $adminEmail. If $False, a summary will only be sent when there are user accounts that need attention.
$alwaysSendAdminSummary = $False

#----- End Configurable Settings -------------------------------------------------------------------------------------------------------------------


#Constant used to determine if password never expires flag is set
$ADS_UF_DONT_EXPIRE_PASSWD = 0x00010000

#Constant used to determine if user must change password at next login
$REQUIRED_PASSWORD_CHANGE_LASTSET = 0

$CurrentDate = [datetime]::Now.Date
$adminEmailContent = ""

$DefaultDomainPasswordPoliy = Get-ADDefaultDomainPasswordPolicy 
$smtp = new-object Net.Mail.SmtpClient($smtpServer)

function GetDaysToExpire([datetime] $expireDate)
{
    $date =  New-TimeSpan $CurrentDate $expireDate
    return $date.Days
}

function GetPasswordExpireDate($user)
{
    return [datetime]::FromFileTimeUTC($user.pwdLastSet+$DefaultDomainPasswordPoliy.MaxPasswordAge.Ticks)
}

function IsInWarningIntervals([int] $daysToExpire)
{
    foreach( $interval in $warningIntervals )
    {
       if ( $daysToExpire -eq $interval )
       {
        return $True
       }
    }
    return $False
}

function EmailUser($user)
{
    $pwdExpires = GetPasswordExpireDate $user
    $daysToExpire = GetDaysToExpire $pwdExpires 

    if( $daysToExpire -eq 0 )
    {
        $emailContent = $user.DisplayName + ", your password will expire today at " + $pwdExpires.ToShortTimeString() + " GMT"
    }
    else
    {
        $emailContent = $user.DisplayName + ", your password will expire in " + $daysToExpire + " days."
    }
    $smtp.Send($fromEmail, $user.mail, "Password Expiration Reminder", $emailContent)
}

function EmailAdmin($content) 
{
    if( [string]::IsNullOrEmpty($content) -and $alwaysSendAdminSummary )
    {
        $content = "There are no user's with expired passwords or users that need to change their password."
    }
    if( [string]::IsNullOrEmpty($content) -ne $True )
    {
        $smtp.Send($fromEmail, $adminEmail, "Password Expiration Summary", $content)
    }
}

function AppendAdminEmailNoMail($user)
{
    $pwdExpires = GetPasswordExpireDate $user
    $daysToExpire = GetDaysToExpire $pwdExpires 

    return "The password for account """ + $user.samAccountName + """ will expire in " + $daysToExpire + " days at " + $pwdExpires + " and there is no associated email address to send a notification to" + [System.Environment]::NewLine + [System.Environment]::NewLine
}

function AppendAdminEmailExpiredAccount($user)
{
    $pwdExpires = GetPasswordExpireDate $user
    $daysToExpire = GetDaysToExpire $pwdExpires 

    if( $user.pwdLastSet -eq 0 )
    {
        return "The user account """ + $user.samAccountName + """ is set to require a password change at next logon and the user has not yet changed it" + [System.Environment]::NewLine + [System.Environment]::NewLine
    }
    else
    {
        return "The password for user account """ + $user.samAccountName + """ expired " + $daysToExpire + " days ago on " + $pwdExpires + [System.Environment]::NewLine + [System.Environment]::NewLine
    }
}


#get all users
$users = Get-AdUser -Filter * -Properties userAccountControl, pwdLastSet, userprincipalname, mail, DisplayName, samAccountName, accountExpires, enabled  #|
# FT -Property @{Label="UAC";Expression={"0x{0:x}" -f $_.userAccountControl}}, userAccountControl, pwdLastSet, @{Label="pwdLastChanged";Expression={[datetime]::FromFileTimeUTC($_.pwdLastSet)}}, @{Label="pwdExpires";Expression={[datetime]::FromFileTimeUTC($_.pwdLastSet+$DefaultDomainPasswordPoliy.MaxPasswordAge.Ticks)}}, userprincipalname, mail, DisplayName, samAccountName, accountExpires, enabled
#$users

foreach( $user in $users ) 
{  
    #if account is enabled and password never expire flag does not exist, then process user
    if ( ($user.enabled -eq $True) -and (($user.userAccountControl -band $ADS_UF_DONT_EXPIRE_PASSWD) -eq 0) ) 
    {        
        $pwdExpires = GetPasswordExpireDate $user 
        $daysToExpire = GetDaysToExpire $pwdExpires 

        #if day falls on warning interval
        if( IsInWarningIntervals $daysToExpire )
        {
            #if mail attribute is not found in AD, add to admin email
            if ( [string]::IsNullOrEmpty($user.mail) ) 
            {
                $adminEmailContent += AppendAdminEmailNoMail $user
            }
            #otherwise email user
            else
            {
                EmailUser $user     
            }
        }

        #if days to expire is negative, password has expired. add to admin email
        if( $daysToExpire -lt 0 )
        {
            $adminEmailContent += AppendAdminEmailExpiredAccount  $user
        }
    }
}

EmailAdmin $adminEmailContent