Password expiration notification problem

Follow

Christian Fournier

• February 05, 2021 08:42

Hi everybody,

I'm trying to configure a password expiration notification self service rule, but Cayosoft Administrator thinks every user has a PwdExpires value which is pwdlastset + 3 days.

For example if pwdlastset is february 4, Cayosoft will send a notification saying password will expire on february 7. However my password expiration policy is 180 days, it should be august 3.

What's the problem, and how can I overcome it ?

 

0

• 

  Tatiana Golubovich

  • February 05, 2021 10:08

  Hi Christian, 

  To troubleshoot this rule can you please run this PowerShell script and send us the result?

  get-aduser -Properties * -Identity <samAccountName> -Server <DCName> | ConvertTo-Json -Depth 3 | Out-File c:\temp\1.txt

   

  Please change <samAccountName> with the problem user samAccountName.

  To get the DC Name in Admin Console navigate to Home > Configuration > Connected Systems Extensions > Active Directory and copy it from the Managed domains table next to the default domain:

   

  Tatiana

    

   

  0

  Comment actions Permalink
• 

  Tatiana Golubovich

  • February 08, 2021 11:51
  • Edited

  Hi Christian, 

  I should ask you to reply to the thread on the Cayosoft Admin community page. Otherwise, our replies are not posted on the community.

  The script I sent you before doesn't request the required attributes. Can you please run the new script below and send us the output file. Don't forget to replace user samAccountName and DC Name:

  get-aduser -Properties PasswordExpired,PasswordNeverExpires,"msDS-UserPasswordExpiryTimeComputed" -Identity <samAccountName> -Server <DCName> | ConvertTo-Json -Depth 3 | Out-File c:\temp\1.txt

  Also, can you check your AD and Exchange schema version by the PowerShell script below?
  You need the PowerShell module for Active Directory on your system. It is available on your domain controllers or on the machine where Cayosoft Administrator is running.
  The version information is read directly from Active Directory, you don’t need an elevated prompt to run it.

  Import-Module ActiveDirectory
  $SchemaVersions = @()
  $SchemaPartition = (Get-ADRootDSE).NamingContexts | ? { $_.SubString(0, 9).ToLower() -eq 'cn=schema' }
  $SchemaVersionAD = (Get-ADObject $SchemaPartition -Property objectVersion).objectVersion
  $SchemaVersions += @{'Active Directory' = $SchemaVersionAD}
  $SchemaPathExchange = "CN=ms-Exch-Schema-Version-Pt,$SchemaPartition"
  If (Test-Path "AD:$SchemaPathExchange") {
   $SchemaVersionExchange = (Get-ADObject $SchemaPathExchange -Property rangeUpper).rangeUpper
  }
  Else {
   $SchemaVersionExchange = 0
  }
  $SchemaVersions += @{'Exchange' = $SchemaVersionExchange}
  Write-Output $SchemaVersions

  Tatiana

  0

  Comment actions Permalink
• 

  Christian Fournier

  • February 08, 2021 19:14

  Hi Tatiana,

  here's the requested outpout :

  "PropertyCount":  14,
      "msDS-UserPasswordExpiryTimeComputed":  132571888357602997,
      "ObjectGUID":  "6ad401dc-6762-4ec6-8a71-f3c233bbe08a",
      "PasswordExpired":  true,
      "PasswordNeverExpires":  false,
      "PwdLastSet":  132569296357602997

  132569296357602997 | get-date --> thursday february 4 0421 16:27:15

  132571888357602997 | get-date --> sunday february 7 0421 16:27:15

  3 days ! So wtf ? I dug a little, and find out there was a fine-grained password policy applied to this user (password expire after 3 days) ! So everything works as expected.

  Thank you for your help, best regards.

   

  0

  Comment actions Permalink
• 

  Tatiana Golubovich

  • February 08, 2021 21:19

  Ok, glad to help! 

  0

  Comment actions Permalink

Please sign in to leave a comment.