{"id":6623,"date":"2012-12-18T08:00:00","date_gmt":"2012-12-18T06:00:00","guid":{"rendered":"http:\/\/nolabnoparty.com\/?p=6623"},"modified":"2014-09-19T09:34:06","modified_gmt":"2014-09-19T07:34:06","slug":"password-expiry-notification-at-logon-in-windows-7","status":"publish","type":"post","link":"https:\/\/nolabnoparty.com\/en\/password-expiry-notification-at-logon-in-windows-7\/","title":{"rendered":"Password expiry notification at logon in Windows 7"},"content":{"rendered":"

\"notifypsw01\"<\/p>\n

In Windows 7 the password expiry notification<\/strong>\u00a0is shown just for few seconds in the bottom right of the screen, five days in advance by default.<\/p>\n

Unfortunately the notification message is not so visible<\/strong> and often it is hard to be noted. The consequence is the password expiration making the network services\u00a0inaccessible to the user.<\/p>\n

<\/p>\n

\"notifypsw02\"<\/p>\n

To solve this situation and having a more clear notification, a\u00a0popup during login and sending an email<\/strong> to the user mailbox could help.<\/p>\n

 <\/p>\n

Display a popup at logon<\/span><\/h2>\n

Showing a popup during login<\/strong> could be a first solution. This target can be achieved using a\u00a0script .vbs launched with GPO<\/strong>.<\/p>\n

In the script here below, the\u00a0warningDays<\/span><\/strong>\u00a0variable<\/strong> specifies how many days notification popup is shown before the password get expired.<\/p>\n

'========================================\r\n' First, get the domain policy.\r\n'========================================\r\nDim oDomain\r\nDim oUser\r\nDim maxPwdAge\r\nDim numDays\r\nDim warningDays\r\nwarningDays = 14\r\nSet LoginInfo = CreateObject(\"ADSystemInfo\") \r\nSet objUser = GetObject(\"LDAP:\/\/\" & LoginInfo.UserName & \"\") \r\n\r\nstrDomainDN = UCase(LoginInfo.DomainDNSName) \r\nstrUserDN = LoginInfo.UserName\r\n\r\nSet oDomain = GetObject(\"LDAP:\/\/\" & strDomainDN)\r\nSet maxPwdAge = oDomain.Get(\"maxPwdAge\")\r\n\r\n'========================================\r\n' Calculate the number of days that are\r\n' held in this value.\r\n'========================================\r\nnumDays = CCur((maxPwdAge.HighPart * 2 ^ 32) + _\r\nmaxPwdAge.LowPart) \/ CCur(-864000000000)\r\n'WScript.Echo \"Maximum Password Age: \" & numDays\r\n\r\n'========================================\r\n' Determine the last time that the user\r\n' changed his or her password.\r\n'========================================\r\nSet oUser = GetObject(\"LDAP:\/\/\" & strUserDN)\r\n\r\n'========================================\r\n' Add the number of days to the last time\r\n' the password was set.\r\n'========================================\r\nwhenPasswordExpires = DateAdd(\"d\", numDays, oUser.PasswordLastChanged)\r\nfromDate = Date\r\ndaysLeft = DateDiff(\"d\",fromDate,whenPasswordExpires)\r\n\r\n'WScript.Echo \"Password Last Changed: \" & oUser.PasswordLastChanged\r\nif (daysLeft < warningDays) and (daysLeft > -1) then\r\nMsgbox \"La password scade tra \" & daysLeft & \" giorni\" & \" il \" & _\r\n  whenPasswordExpires &chr(13) & chr(13) & \"Premi CTRL + ALT + CANC \" &_\r\n    \"e seleziona l'opzione 'Cambia password'.\", 0, \"AVVISO SCADENZA PASSWORD\"\r\nEnd if\r\n\r\n'========================================\r\n' Clean up.\r\n'========================================\r\nSet oUser = Nothing\r\nSet maxPwdAge = Nothing\r\nSet oDomain = Nothing<\/pre>\n
To execute the script during login<\/strong>, create a new GPO with the tool\u00a0Group Policy Management<\/strong>. Right click Group Policy Objects<\/strong> item and select New<\/strong>.<\/p>\n
\"notifypsw03\"<\/p>\n
Type a Name<\/strong> for the new GPO then click\u00a0OK<\/strong>.<\/p>\n
\"notifypsw04\"<\/p>\n
Edit the GPO and select User Configuration > Policies > Windows Settings > Scripts (Logon\/Logoff)<\/strong>\u00a0option and right click Logon > Properties<\/strong>.<\/p>\n
\"notifypsw05\"<\/p>\n
In the Scripts\u00a0<\/strong>section, click\u00a0Add<\/strong>\u00a0and specify the .vbs file<\/strong>\u00a0to be used through the\u00a0Browse<\/strong>\u00a0button.<\/p>\n
\"notifypsw06\"<\/p>\n
Select the script then click\u00a0Open<\/strong>.<\/p>\n
\"notifypsw07\"<\/p>\n
Once the script .vbs<\/strong> has been set, click\u00a0OK<\/strong>\u00a0to save the configuration.<\/p>\n
\"notifypsw08\"<\/p>\n
Link the new GPO<\/strong>\u00a0to the correct OU.<\/p>\n
\"notifypsw09\"<\/p>\n
When the user login into the system<\/strong>, the script displays the popup notification<\/strong>.<\/p>\n
\"notifypsw10\"<\/p>\n
 <\/p>\n
Sending a notification email<\/span><\/h2>\n
To make the password notification as clear as possible, in addition to the popup during the login, we could send also an email<\/strong> to the user mailbox.<\/p>\n
The email is sent using a\u00a0PowerShell script<\/strong>\u00a0launched at logon. The script in the example has been taken from the\u00a0www.rlmueller.net<\/a>\u00a0website and customized to match the network environment.<\/p>\n
Trap {\"Error: $_\"; Break;}\r\n\r\n# Specify number of days. Any users whose passwords expire within\r\n# this many days after today will be processed.\r\n$intDays = 14\r\n\r\n# Email settings.\r\n$Script:From = \"myemailaddress@mydomain.com\"\r\n$Script:Subject = \"Password Expiration Notice\"\r\n$Server = \"smtp.mydomain.com\"\r\n$Port = 25\r\n$Client = New-Object System.Net.Mail.SmtpClient $Server, $Port\r\n# You may need to provide credentials.\r\n$Client.Credentials = [System.Net.CredentialCache]::DefaultNetworkCredentials\r\n\r\nFunction SendEmail($To, $Body)\r\n{\r\n    $Message = New-Object System.Net.Mail.MailMessage `\r\n        $Script:From, $To, $Script:Subject, $Body\r\n    $Client.Send($Message)\r\n}\r\n\r\n# Retrieve Domain maximum password age policy, in days.\r\n$D = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()\r\n$Domain = [ADSI]\"LDAP:\/\/$D\"\r\n$MPA = $Domain.maxPwdAge.Value\r\n# Convert to Int64 ticks (100-nanosecond intervals).\r\n$lngMaxPwdAge = $Domain.ConvertLargeIntegerToInt64($MPA)\r\n# Convert to days.\r\n$MaxPwdAge = -$lngMaxPwdAge\/(600000000 * 1440)\r\n\r\n# Determine the password last changed date such that the password\r\n# would just now be expired. We will not process any users whose\r\n# password has already expired.\r\n$Now = Get-Date\r\n$Date1 = $Now.AddDays(-$MaxPwdAge)\r\n\r\n# Determine the password last changed date such the password\r\n# will expire $intDays in the future.\r\n$Date2 = $Now.AddDays($intDays - $MaxPwdAge)\r\n\r\n# Convert from PowerShell ticks to Active Directory ticks.\r\n$64Bit1 = $Date1.Ticks - 504911232000000000\r\n$64Bit2 = $Date2.Ticks - 504911232000000000\r\n\r\n$Searcher = New-Object System.DirectoryServices.DirectorySearcher\r\n$Searcher.PageSize = 200\r\n$Searcher.SearchScope = \"subtree\"\r\n\r\n# Filter on user objects where the password expires between the\r\n# dates specified, the account is not disabled, password never\r\n# expires is not set, password not required is not set.\r\n# and password cannot change is not set.\r\n$Searcher.Filter = \"(&(objectCategory=person)(objectClass=user)\" `\r\n    + \"(pwdLastSet>=\" + $($64Bit1) + \")\" `\r\n    + \"(pwdLastSet<=\" + $($64Bit2) + \")\" `\r\n    + \"(!userAccountControl:1.2.840.113556.1.4.803:=2)\" `\r\n    + \"(!userAccountControl:1.2.840.113556.1.4.803:=65536)\" `\r\n    + \"(!userAccountControl:1.2.840.113556.1.4.803:=32)\" `\r\n    + \"(!userAccountControl:1.2.840.113556.1.4.803:=48))\"\r\n\r\n$Searcher.PropertiesToLoad.Add(\"sAMAccountName\") > $Null\r\n$Searcher.PropertiesToLoad.Add(\"pwdLastSet\") > $Null\r\n$Searcher.PropertiesToLoad.Add(\"mail\") > $Null\r\n$Searcher.PropertiesToLoad.Add(\"proxyAddresses\") > $Null\r\n$Searcher.SearchRoot = \"LDAP:\/\/\" + $Domain.distinguishedName\r\n\r\n$Results = $Searcher.FindAll()\r\nForEach ($Result In $Results)\r\n{\r\n    $Name = $Result.Properties.Item(\"sAMAccountName\")\r\n    $PLS = $Result.Properties.Item(\"pwdLastSet\")\r\n    $Mail = $Result.Properties.Item(\"mail\")\r\n    $Addresses = $Result.Properties.Item(\"proxyAddresses\")\r\n    If ($PLS.Count -eq 0)\r\n    {\r\n        $Date = [DateTime]0\r\n    }\r\n    Else\r\n    {\r\n        # Interpret 64-bit integer as a date.\r\n        $Date = [DateTime]$PLS.Item(0)\r\n    }\r\n    # Convert from .NET ticks to Active Directory Integer8 ticks.\r\n    # Also, convert from UTC to local time.\r\n    $PwdLastSet = $Date.AddYears(1600).ToLocalTime()\r\n    # Determine when password expires.\r\n    $PwdExpires = $PwdLastSet.AddDays($MaxPwdAge)\r\n\r\n    # Determine email address.\r\n    If (\"$Mail\" -eq \"\")\r\n    {\r\n        ForEach ($Address In $Addresses)\r\n        {\r\n            $Prefix = $Address.SubString(0, 5)\r\n            If (($Prefix -ceq \"SMTP:\") -or ($Prefix -ceq \"X400:\"))\r\n            {\r\n                $Mail = $Address.SubString(5)\r\n                Break\r\n            }\r\n        }\r\n    }\r\n    If (\"$Mail\" -ne \"\")\r\n    {\r\n        $Notice = \"Password for user $Name must be changed by $PwdExpires\"\r\n        SendEmail $Mail $Notice\r\n        \"Email sent to $Name ($Mail), password expires $PwdExpires\"\r\n    }\r\n    Else\r\n    {\r\n        \"$Name has no email, but password expires $PwdExpires\"\r\n        \"DN: $DN\"\r\n    }\r\n}<\/pre>\n
The script is added to the\u00a0previously\u00a0created GPO by editing\u00a0\u00a0the option\u00a0User Configuration > Policies > Windows Settings > Scripts (Logon\/Logoff)<\/strong>. Right click Logon > Properties<\/strong>.<\/p>\n
Select\u00a0PowerShell Scripts<\/strong>\u00a0pane and click\u00a0Add<\/strong>. Click the Browse<\/strong>\u00a0button and select this time the\u00a0script .ps1<\/strong>.<\/p>\n
\"notifypsw11\"<\/p>\n
Select the script .ps1<\/strong>\u00a0then click\u00a0Open<\/strong>.<\/p>\n
\"notifypsw12\"<\/p>\n
If you are going to use both solutions, you can set an execution scripts order\u00a0setting the option \u201cFor this GPO, run scripts in the following order<\/strong>\u201d. Click\u00a0OK<\/strong>\u00a0to save the configuration.<\/p>\n
\"notifypsw13\"<\/p>\n
At logon,\u00a0in addition to the popup<\/strong>\u00a0the user will receive also a notification email\u00a0<\/strong>in his\/her mailbox.<\/p>\n
\"notifypsw14\"<\/p>\n
Notify the password expiration with a popup, with an email or with both solutions depends on corporate policies and needs<\/strong>. You could set the system to show initially only the popup then the email.<\/p>\n
 <\/p>\n
Update\u00a025\/08\/2014<\/h4>\n
To execute\u00a0the script powershell avoiding the problem of emails generated for each user that logs on the system, run the script on daily basis using the\u00a0Windows\u00a0Task Scheduler<\/strong>\u00a0removing\u00a0the\u00a0script from the GPO.<\/p>\n
Create a new task\u00a0in the\u00a0Task Scheduler and set parameters as follow:<\/p>\n
    \n
  • Action: Start a program<\/li>\n
  • Program\/Script: powershell.exe<\/li>\n
  • Add arguments (optional): -f \u201cC:\\Scripts\\psw_warning_email.ps1?<\/li>\n<\/ul>\n
    Configure the execution with the following options:<\/p>\n
      \n
    • Use the following user account:\u00a0a Domain Admin account<\/em><\/li>\n
    • Run whether user is logged on or not<\/li>\n
    • Run with highest privileges<\/li>\n<\/ul>\n
       <\/p>\n
      \"\"<\/p>\n","protected":false},"excerpt":{"rendered":"
      In Windows 7 the password expiry notification\u00a0is shown just for few seconds in the bottom right of the screen, five days in advance by default. Unfortunately the notification message is not so visible and often it is hard to be noted. The consequence is the password expiration making the network services\u00a0inaccessible to the user.<\/p>\n","protected":false},"author":3,"featured_media":5577,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rop_custom_images_group":[],"rop_custom_messages_group":[],"rop_publish_now":"initial","rop_publish_now_accounts":{"linkedin_93tdZWzMZc_93tdZWzMZc":"","facebook_2879994398731222_17841400390232720":"","twitter_113568041_113568041":"","mastodon_115463926174894442_115463926174894442":""},"rop_publish_now_history":[],"rop_publish_now_status":"pending","footnotes":""},"categories":[913,1065],"tags":[663,605,607,602],"class_list":["post-6623","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-active-directory-en","category-microsoft-en","tag-expiry","tag-gpo-en","tag-notification-en","tag-password-en","has_thumb"],"_links":{"self":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/posts\/6623","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/comments?post=6623"}],"version-history":[{"count":0,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/posts\/6623\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/media\/5577"}],"wp:attachment":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/media?parent=6623"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/categories?post=6623"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/tags?post=6623"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}