Many organizations have policies that force users to change their passwords periodically. If a user doesn't change the password before the expiration date, they will be forced to set a new password when they log in for the first time after its expiration.
While password deadlines are a minor inconvenience for users who are within the corporate network, remote users who ignore them will be locked out. This is because sensitive tasks like password resets need to be performed only from within the corporate network hosting Active Directory (AD). For remote users, contacting the help desk to reset the password does not help since the device must be located physically within the corporate intranet.
Native AD tools do not offer the functionality to notify users of password expiration deadlines. Luckily, admins can use PowerShell scripts to notify users of password expiration for AD and email them to change their passwords a few days in advance.
ManageEngine ADSelfService Plus, an identity security solution, also supports sending password expiration notifications to AD users. The PowerShell password expiration notification script provided below sends email reminders to Active Directory users about their expiring passwords.
| PowerShell | ManageEngine ADSelfService Plus |
|---|---|
|
Use the following PowerShell script to check user password expiration dates and send an expiry notification email seven days in advance: #Import AD Module Import-Module ActiveDirectory #Create warning dates for future password expiration $SevenDayWarnDate = (get-date).adddays(7).ToLongDateString() #Email Variables $MailSender = " Password AutoBot <emailaddress@somecompany.com>" $Subject = 'FYI - Your account password will expire soon' $EmailStub1 = 'I am a bot and performed this action automatically. I am here to inform you that the password for' $EmailStub2 = 'will expire in' $EmailStub3 = 'days on' $EmailStub4 = '. Please contact the help desk if you need assistance changing your password. DO NOT REPLY TO THIS EMAIL.' $SMTPServer = 'smtp.somecompany.com' #Find accounts that are enabled and have expiring passwords $users = Get-ADUser -filter {Enabled -eq $True -and PasswordNeverExpires -eq $False -and PasswordLastSet -gt 0 } ` -Properties "Name", "EmailAddress", "msDS-UserPasswordExpiryTimeComputed" | Select-Object -Property "Name", "EmailAddress", ` @{Name = "PasswordExpiry"; Expression = {[datetime]::FromFileTime($_."msDS-UserPasswordExpiryTimeComputed").tolongdatestring() }} #check password expiration date and send email on match foreach ($user in $users) { if ($user.PasswordExpiry -eq $SevenDayWarnDate) { $days = 7 $EmailBody = $EmailStub1, $user.name, $EmailStub2, $days, $EmailStub3, $SevenDayWarnDate, $EmailStub4 -join ' ' Send-MailMessage -To $user.EmailAddress -From $MailSender -SmtpServer $SMTPServer -Subject $Subject -Body $EmailBody } else {} } |
|
Many admins rely on a password expiration notification process that's built using PowerShell scripts. A password expiry email notification PowerShell script can send reminders before a user’s password expires, but it requires constant maintenance and troubleshooting. Even well-known scripts like password-expiration-notifications.ps1 can fail after security updates or PowerShell script changes.
While a PowerShell password expiration notification email can automate alerts, it offers little visibility into whether messages were delivered or acted upon. Missed or failed password expiry notifications can lead to account lockouts, frustrated users, increased help desk tickets, and even compliance gaps.
Instead of maintaining a password expiration notification PowerShell script, ADSelfService Plus provides a built-in, code-free password expiry notification feature. Here is why you should choose ADSelfService Plus as your password expiry notifier tool:
