Option Explicit
Call PwdExpiryInfo
Sub PwdExpiryInfo()
' Version 1.0
' Writen by Krystian Karia
' Dated 04/05/2009
' Gets a list of users from the group
' specified and then checks their
' Password Expiry date.
' NOTE: Script must be run in a CMD.exe
' window as: CScript.exe ScriptName.vbs
' This is due to the number of outputs
' that is created.
' Catch errors ourselves
' On Error Resume Next
' Declare Variables
dim iTimeInterval, iMaxPwdAge
Dim i, intUACvalue
Dim dtmPwdChanged
Dim objUserLDAP
Dim arrMembers
Const ADS_UF_DONT_EXPIRE_PASSWD = &h10000
Const sGroup = "OU=DLI_ACCOUNTS,DC=dli,DC=local" ' < Spcify your group name here
' Get the list of users from the given group
arrMembers = GetMembers(sGroup)
If IsNull(arrMembers) Then
ShowProgress "Check your group name or its member list"
EndScript
End If
' Loop each user to check password exiry date
For i = 0 to UBound(arrMembers)
If arrMembers(i) <> "" Then
ShowProgress ""
Set objUserLDAP = GetObject(arrMembers(i))
intUACvalue = objUserLDAP.Get("userAccountControl")
If intUACvalue And ADS_UF_DONT_EXPIRE_PASSWD Then
ShowProgress objUserLDAP.sAMAccountName
ShowProgress " Password does not expire"
Else
dtmPwdChanged = objUserLDAP.PasswordLastChanged
iTimeInterval = CInt(Now - dtmPwdChanged)
iMaxPwdAge = GetMaxPwdAge
ShowProgress objUserLDAP.sAMAccountName
ShowProgress " Password was last changed " & dtmPwdChanged
ShowProgress " Which was " & iTimeInterval & " days ago"
If iMaxPwdAge < 0 Then
ShowProgress " Password does not expire (Domain Policy's Maximum Password Age set to 0)"
Else
ShowProgress " The Domain Policy Max Password Age is " & iMaxPwdAge & " Days"
If iTimeInterval >= iMaxPwdAge Then
ShowProgress " The password has expired."
Else
ShowProgress " The password will expire in " & CInt((dtmPwdChanged + iMaxPwdAge) - Now()) & " Days"
End If
End If 'iMaxPwdAge
End If 'intUACvalue
End If
Next ' arrMembers
End Sub ' PwdExpiryInfo
Function GetMembers(strGroup)
' Version 1.4
' Written by Krystian Karia
' Dated 04/05/2009
' Returns the LDAP path of each
' user from the given group
' Catch errors ourselves
On Error Resume Next
' Declare variables
Dim oGroup, oUser
Dim strName
Dim arrUsers
' Check parameters
If strGroup = "" Then
GetMembers = Null
Exit Function
End If
' Bind to group using the correct ADSI connector
Set oGroup = GetObject("LDAP://" & strGroup)
If Err.Number <> 0 Then
Err.Clear
ShowProgress "An error occured binding to the group " & strGroup
GetMembers = Null
Exit Function
End If
' Loop group members
For Each oUser In oGroup.Members
strName = strName & oUser.ADsPath & vbNewLine
Next
' Create an array of members
If Trim(strName) <> "" Then
arrUsers = Split(strName, vbNewLine)
GetMembers = arrUsers
Else
GetMembers = Null
End If
Err.Clear
End Function ' GetMembers
Function GetMaxPwdAge()
' Version 1.0
' Returns the Maximum Password Age
' which is usually set in the GPO
' named "Default Domain Policy"
' Catch errors ourselves
On Error Resume Next
' Declare Variables
Dim oRootDSE, oDomain, oMaxPwdAge
Dim lngHighPart, lngLowPart
Dim strDomainDN
' Get the current Domain DN
Set oRootDSE = GetObject("LDAP://RootDSE")
strDomainDN = oRootDSE.Get("DefaultNamingContext")
' Bind to current Domain
Set oDomain = GetObject("LDAP://" & strDomainDN)
Set oMaxPwdAge = oDomain.MaxPwdAge
' Get the 2 parts of the Integer8 value to get 2 32 bit values
lngHighPart = oMaxPwdAge.HighPart
lngLowPart = oMaxPwdAge.LowPart
' If the LowPart is less than 0 then we ned to add 1 to the HighPart
If (lngLowPart < 0) Then
lngHighPart = lngHighPart + 1
End If
' Return the value in Days
GetMaxPwdAge = -((lngHighPart * 2^32) + lngLowPart)/(600000000 * 1440)
End Function ' GetMaxPwdAge
Sub ShowProgress(sComment)
WScript.Echo sComment
End Sub
Sub EndScript
WScript.Quit
End Sub
|
