How to exprie ALL acct. passwords?

  • Thread starter Thread starter Lamar Thomas
  • Start date Start date
L

Lamar Thomas

We are running Windows 2003 Servers as our domain controllers and about 5000
users. What we want to do is expire EVERYONE'S network acct. and make them
change their passwords at the end of this week (Friday). Any ideas on an
easy way to do this?


Thanks in advance,


Clayton
 
Lamar said:
We are running Windows 2003 Servers as our domain controllers and about 5000
users. What we want to do is expire EVERYONE'S network acct. and make them
change their passwords at the end of this week (Friday). Any ideas on an
easy way to do this?
Click to expand...

You want to expire all passwords - not expire account? So just force
users to change the password? - It's easy with ADSI script, for each
account You should modify pwdLastSet and set it to 0:

http://www.rallenhome.com/books/adcookbook/src/06.21-must_change_passwd.vbs.txt

This will force users to change password at next logon.
 
Lamar said:
We are running Windows 2003 Servers as our domain controllers and about 5000
users. What we want to do is expire EVERYONE'S network acct. and make them
change their passwords at the end of this week (Friday). Any ideas on an
easy way to do this?


Thanks in advance,


Clayton
Click to expand...

Think You can possibly do this with ADModify. Though I'm at home at the
mo, and can't remember oif the top of my head.

That just incase you can't be arsed to script. Though if you can't, I
suggest learning. It's the way forward :)
 
Lamar Thomas said:
We are running Windows 2003 Servers as our domain controllers and about
5000
users. What we want to do is expire EVERYONE'S network acct. and make
them
change their passwords at the end of this week (Friday). Any ideas on an
easy way to do this?
Click to expand...

Hello Lamar,

That's also pretty easy via the command line, the command should look
like

Dsquery user domainroot | dsmod user -mustchpwd yes

Please test that first, I can't test that right now - minor
modifications might be necessary. Also note that you might not want all
user accounts (like the administrator, serviceaccounts) so should
modify the scope of your search as necessary (e.g. to a MyCorpUsers-OU)
instead of using the domainroot.

--
Gruesse - Sincerely,

Ulf B. Simon-Weidner

MVP-Book "Windows XP - Die Expertentipps": http://tinyurl.com/44zcz
Weblog: http://msmvps.org/UlfBSimonWeidner
WebSite: http://www.windowsserverfaq.org
 
adfind -b dc=domain,dc=com -f samaccounttype=805306368 |admod pwdlastset::0

That will expire every userid's password that you have permission to expire.

If you want to focus on a specific OU, specify that in the base DN specified by -b

You can get adfind and admod from www.joeware.net

joe
 
Back
Top