Password Expired Reminder Task With Script

Create Task in Task Scheduler that running on all Active Directory users And send email to the user that he needs to change password day after day.

Add arguments —> file “C:\Scripts\PwdExpireHTML.Ps1”

The Script :

#################################################################################################################
# 
# Version 1.0 01.2021
# Uriel Zion 
# Https://uriel.zion.com
# Script to Automated Email Reminders when Users Passwords due to Expire.
#
# Requires: Windows PowerShell Module for Active Directory
#
# 
##################################################################################################################
# Please Configure the following variables....
$smtpServer="SmtpServer"
$expireindays = 14
$from = "Administrator@Domain_Name"
$logging = "Enabled" # Set to Disabled to Disable Logging
$logFile = "c:\scripts\pwdexpirehtml\PwdExipreHTML.csv" # ie. c:\mylog.csv
$testing = "Disabled" # Set to Disabled to Email Users
$testRecipient = "Email_Address"
$date = Get-Date -format ddMMyyyy
#
###################################################################################################################

# Check Logging Settings
if (($logging) -eq "Enabled")
{
    # Test Log File Path
    $logfilePath = (Test-Path $logFile)
    if (($logFilePath) -ne "True")
    {
        # Create CSV File and Headers
        New-Item $logfile -ItemType File
        Add-Content $logfile "Date,Name,EmailAddress,DaystoExpire,ExpiresOn"
    }
} # End Logging Check

# Get Users From AD who are Enabled, Passwords Expire and are Not Currently Expired
Import-Module ActiveDirectory
$users = get-aduser -filter * -properties Name, PasswordNeverExpires, PasswordExpired, PasswordLastSet, EmailAddress |where {$_.Enabled -eq "True"} | where { $_.PasswordNeverExpires -eq $false } | where { $_.passwordexpired -eq $false }
$maxPasswordAge = (Get-ADDefaultDomainPasswordPolicy).MaxPasswordAge

# Process Each User for Password Expiry
foreach ($user in $users)
{
    $Name = (Get-ADUser $user | foreach { $_.Name})
    $emailaddress = $user.emailaddress
    $passwordSetDate = (get-aduser $user -properties * | foreach { $_.PasswordLastSet })
    $PasswordPol = (Get-AduserResultantPasswordPolicy $user)
    # Check for Fine Grained Password
    if (($PasswordPol) -ne $null)
    {
        $maxPasswordAge = ($PasswordPol).MaxPasswordAge
    }
  
    $expireson = $passwordsetdate + $maxPasswordAge
    $today = (get-date)
    $daystoexpire = (New-TimeSpan -Start $today -End $Expireson).Days
        
    # Set Greeting based on Number of Days to Expiry.

# Check Number of Days to Expiry
    $messageDays = $daystoexpire

if (($messageDays) -ge "1")
    {
        $messageDays = "in " + "$daystoexpire" + " days."
    }
    else
    {
        $messageDays = "today."
    }

# Email Subject Set Here
 $subject="Your password will expire $messageDays"
 
 # Email Body Set Here, Note You can use HTML, including Images.
 $body ="
 Dear $name,
 Your Password will expire $messageDays. 
 To change your password, follow the method below
On your Windows computer
a.&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;If you are&nbsp;not&nbsp;in the office, logon and connect to VPN
b.&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;Log onto your computer as usual and make sure you are connected to the internet
c. &nbsp; &nbsp; &nbsp; &nbsp;Press Ctrl-Alt-Del and click on ""Change Password""
d.&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;Fill in your old password and set a new password. &nbsp;See the password requirements below
e&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Press OK to return to your desktop.&nbsp;
&nbsp;
The new password must meet the minimum requirements set forth in our corporate policies including:
1. &nbsp; &nbsp; &nbsp; &nbsp; It must be at least 8 characters long.
2. &nbsp; &nbsp; &nbsp; &nbsp;It must contain at least one character from 3 of the 4 following groups of characters:
&nbsp; &nbsp; &nbsp; a. &nbsp;Uppercase letters (A-Z)
&nbsp; &nbsp; &nbsp; b. &nbsp;Lowercase letters (a-z)
&nbsp; &nbsp; &nbsp; c. &nbsp;Numbers&nbsp;(0-9)
&nbsp; &nbsp; &nbsp; d. &nbsp;Symbols&nbsp;(!@#$%^&amp;*...)
3. It cannot match any of your past 6 passwords.
4. It cannot contain characters which match 3 or more consecutive characters of your username
&nbsp;
If you have any questions please contact our Support team at&nbsp;"Support_Mail@DomainName";
or call us at "Support Number"
&nbsp;
Thanks,
System IT
CompanyName
"

# If Testing Is Enabled - Email Administrator
    if (($testing) -eq "Enabled")
    {
        $emailaddress = $testRecipient
    } # End Testing

# If a user has no email address listed
    if (($emailaddress) -eq $null)
    {
        $emailaddress = $testRecipient    
    }# End No Valid Email

# Send Email Message
    if (($daystoexpire -ge "0") -and ($daystoexpire -lt $expireindays))
    {
         # If Logging is Enabled Log Details
        if (($logging) -eq "Enabled")
        {
            Add-Content $logfile "$date,$Name,$emailaddress,$daystoExpire,$expireson" 
        }
        # Send Email Message
        Send-Mailmessage -smtpServer $smtpServer -from $from -to $emailaddress -subject $subject -body $body -bodyasHTML -priority High

} # End Send Message
    
} # End User Processing

# End

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

#################################################################################################################

# Version 1.0 01.2021

# Uriel Zion

# Https://uriel.zion.com

# Script to Automated Email Reminders when Users Passwords due to Expire.

# Requires: Windows PowerShell Module for Active Directory

##################################################################################################################

# Please Configure the following variables....

$smtpServer="SmtpServer"

$expireindays = 14

$from = "Administrator@Domain_Name"

$logging = "Enabled" # Set to Disabled to Disable Logging

$logFile = "c:\scripts\pwdexpirehtml\PwdExipreHTML.csv" # ie. c:\mylog.csv

$testing = "Disabled" # Set to Disabled to Email Users

$testRecipient = "Email_Address"

$date = Get-Date -format ddMMyyyy

###################################################################################################################

# Check Logging Settings

if (($logging) -eq "Enabled")

{

# Test Log File Path

$logfilePath = (Test-Path $logFile)

if (($logFilePath) -ne "True")

{

# Create CSV File and Headers

New-Item $logfile -ItemType File

Add-Content $logfile "Date,Name,EmailAddress,DaystoExpire,ExpiresOn"

}

} # End Logging Check

# Get Users From AD who are Enabled, Passwords Expire and are Not Currently Expired

Import-Module ActiveDirectory

$users = get-aduser -filter * -properties Name, PasswordNeverExpires, PasswordExpired, PasswordLastSet, EmailAddress |where {$_.Enabled -eq "True"} | where { $_.PasswordNeverExpires -eq $false } | where { $_.passwordexpired -eq $false }

$maxPasswordAge = (Get-ADDefaultDomainPasswordPolicy).MaxPasswordAge

# Process Each User for Password Expiry

foreach ($user in $users)

{

$Name = (Get-ADUser $user | foreach { $_.Name})

$emailaddress = $user.emailaddress

$passwordSetDate = (get-aduser $user -properties * | foreach { $_.PasswordLastSet })

$PasswordPol = (Get-AduserResultantPasswordPolicy $user)

# Check for Fine Grained Password

if (($PasswordPol) -ne $null)

{

$maxPasswordAge = ($PasswordPol).MaxPasswordAge

}

$expireson = $passwordsetdate + $maxPasswordAge

$today = (get-date)

$daystoexpire = (New-TimeSpan -Start $today -End $Expireson).Days

# Set Greeting based on Number of Days to Expiry.

# Check Number of Days to Expiry

$messageDays = $daystoexpire

if (($messageDays) -ge "1")

{

$messageDays = "in " + "$daystoexpire" + " days."

}

else

{

$messageDays = "today."

}

# Email Subject Set Here

$subject="Your password will expire $messageDays"

# Email Body Set Here, Note You can use HTML, including Images.

$body ="

Dear $name,

Your Password will expire $messageDays.

To change your password, follow the method below

On your Windows computer

a.         If you are not in the office, logon and connect to VPN

b.        Log onto your computer as usual and make sure you are connected to the internet

c.        Press Ctrl-Alt-Del and click on ""Change Password""

d.        Fill in your old password and set a new password.  See the password requirements below

e         Press OK to return to your desktop.

The new password must meet the minimum requirements set forth in our corporate policies including:

1.         It must be at least 8 characters long.

2.        It must contain at least one character from 3 of the 4 following groups of characters:

a.  Uppercase letters (A-Z)

b.  Lowercase letters (a-z)

c.  Numbers (0-9)

d.  Symbols (!@#$%^&*...)

3. It cannot match any of your past 6 passwords.

4. It cannot contain characters which match 3 or more consecutive characters of your username

If you have any questions please contact our Support team at "Support_Mail@DomainName";

or call us at "Support Number"

Thanks,

System IT

CompanyName

"

# If Testing Is Enabled - Email Administrator

if (($testing) -eq "Enabled")

{

$emailaddress = $testRecipient

} # End Testing

# If a user has no email address listed

if (($emailaddress) -eq $null)

{

$emailaddress = $testRecipient

}# End No Valid Email

# Send Email Message

if (($daystoexpire -ge "0") -and ($daystoexpire -lt $expireindays))

{

# If Logging is Enabled Log Details

if (($logging) -eq "Enabled")

{

Add-Content $logfile "$date,$Name,$emailaddress,$daystoExpire,$expireson"

}

# Send Email Message

Send-Mailmessage -smtpServer $smtpServer -from $from -to $emailaddress -subject $subject -body $body -bodyasHTML -priority High

} # End Send Message

} # End User Processing

# End

Result :

Password Expired Reminder Task With Script