Question

So, I we have a few users that their computers are not on the domain. One of the annoying things about that is windows will not notify them that their domain password is expired obviously. So I decided I was going to put together a little script using powershell in windows that checks AD to see when their password expires and then if it's about to expire in 3 days to send the user an email to notify them that they should change their password.

I have it set up right now to look at the users distinguished name to pull all the necessary information. but I can only do that for one person, I need to look at two user's distinguished names and send each of them an email when their password is about to expire. I tried creating another $DN variable that I could put the other Distinguished name into and put get-aduser -searchbase $DN, $DN2 but that didn't work for me. Probably was a dumb thing to try, but not sure the syntax needed to accomplish this. Below is my code.

$smtpServer="smtp.office365.com" # Office 365 official smtp server 
$expireindays = 100 # number of days for password to expire  
$from =  # email from  
#$logging = "$true" # Set to Disabled to Disable Logging 
$logFile = "c:\Scripts\PasswordChangeNotification.csv" # ie. c:\Scripts\PasswordChangeNotification.csv 
#$testing = "Disabled" # Set to Disabled to Email Users 
$testRecipient =   
$date = Get-Date -format ddMMyyyy
$DN = "Distinguished name here"
# Add EMAIL Function 
Function EMAIL{ 

    Param( 
        $emailSmtpServer = $smtpServer,   #change to your SMTP server 
        $emailSmtpServerPort = 587, 
        $emailSmtpUser = "User"
        $emailSmtpPass = "Password",   #Password for Send from email account 
        $emailFrom = "email@domain.com",   #Email account you want to send from 
        $emailTo, 
        $emailAttachment, 
        $emailSubject, 
        $emailBody 
    ) 
    Process{ 

    $emailMessage = New-Object System.Net.Mail.MailMessage( $emailFrom , $emailTo ) 
    $emailMessage.Subject = $emailSubject 
    $emailMessage.IsBodyHtml = $true 
    $emailMessage.Priority = [System.Net.Mail.MailPriority]::High 
    $emailMessage.Body = $emailBody 

    $SMTPClient = New-Object System.Net.Mail.SmtpClient( $emailSmtpServer , $emailSmtpServerPort ) 
    $SMTPClient.EnableSsl = $true 
    $SMTPClient.Credentials = New-Object System.Net.NetworkCredential( $emailSmtpUser , $emailSmtpPass ); 

    $SMTPClient.Send( $emailMessage ) 
    } 
} 

# Get Users From AD who are Enabled, Passwords Expire and are Not Currently Expired 
Import-Module ActiveDirectory 
$users = get-aduser -SearchBase $DN -filter * -properties Name, PasswordNeverExpires, PasswordExpired, PasswordLastSet, EmailAddress |where {$_.Enabled -eq "True"} | where { $_.PasswordNeverExpires -eq $false } | where { $_.passwordexpired -eq $false }
$DefaultmaxPasswordAge = (Get-ADDefaultDomainPasswordPolicy).MaxPasswordAge

# Process Each User for Password Expiry 
foreach ($user in $users) 
{ 
    $Name = $user.Name 
    $emailaddress = $user.emailaddress 
    $passwordSetDate = $user.PasswordLastSet 
    $PasswordPol = (Get-AduserResultantPasswordPolicy $user) 
    # Check for Fine Grained Password 
    if (($PasswordPol) -ne $null) 
    { 
        $maxPasswordAge = ($PasswordPol).MaxPasswordAge 
    } 
    else 
    { 
        # No FGP set to Domain Default 
        $maxPasswordAge = $DefaultmaxPasswordAge 
    } 

    $expireson = $passwordsetdate + $maxPasswordAge 
    $today = (get-date) 
    $daystoexpire = (New-TimeSpan -Start $today -End $Expireson).Days 

    # Set Greeting based on Number of Days to Expiry. 

    # Check Number of Days to Expiry 
    $messageDays = $daystoexpire 

    if (($messageDays) -ge "1") 
    { 
        $messageDays = "in " + "$daystoexpire" + " days." 
    } 
    else 
    { 
        $messageDays = "today." 
    } 

    # Email Subject Set Here 
    $subject="Your password will expire $messageDays" 

    # Email Body Set Here, Note You can use HTML, including Images. 
    $body ="     
    <p>Dear $name,<br></P><br> 
    <p>Your domain password will expire $messageDays<br><br> 
    Please change your password before it expires.<br></P><br><br> 
    <p>Thanks, <br>

    } # End Send Message 

} # End User Processing  
# End

I am just trying to get some insight on how I could modify my code to use two Distinguished names instead of just the one. I'm sure this isn't the best way to do this, but I'm not too good with coding yet. Hopefully this all makes sense, I appreciate the help!

Answer 1

您已经发现，可以将DN值存储在数组$DNs中并处理该数组的每个元素。括号内的两个表达式仅因您提供的$DN变量而不同。使用Foreach循环的效果比传递到ForEach-Object的效果略好，但是在您的情况下，可以忽略不计。

$users = Foreach ($DN in $DNs) {
  get-aduser -SearchBase $DN -filter {
  Enabled -eq "True" -and 
  PasswordNeverExpires -eq "False" -and 
  passwordexpired -eq "False" 
  } -properties Name, PasswordNeverExpires, PasswordExpired, PasswordLastSet, EmailAddress)

通过这种方式还有其他好处：

删除Where-Object：Get-ADUser拥有自己的过滤器作为参数，与在某些查询中使用where相比，可以大大提高性能。随着Get-ADUser查询返回的用户数量的增加，这里的速度应该更快。

Answer 2

知道了！

我将$ DN更改为： $DN = "Distinguished name","Distinguished name" 然后将我的get-aduser代码更改为： $users= $DN | ForEach-Objects {get-aduser -SearchBase $PSItem -filter * .....

谢谢

Email Password Expiry Reminder to Multiple Users

2 个答案: