Blog Post

Core Infrastructure and Security Blog

5 MIN READ

How to Setup a Password Expiration Notification Email Solution

MichaelHildebrand

Microsoft

Sep 20, 2018

First published on TechNet on May 04, 2015

"Hello World!"

Hi there! Mike Kullish, here. I'm a PFE based out of Minneapolis, MN with a focus on AD, Hyper-V and DFS but I try to help customers with anything on the Windows Desktop and/or Server platforms. I have been with Microsoft for nearly three years and this is my first blog post.

Have you ever had a need to configure notifications for user's password expirations but found that existing solutions didn't quite fit the bill? We all know you can use built-in solutions with Windows and Active Directory/Group Policy but this requires users to interactively log-on to a network-based computer. What about those BYOD or mobile users or users of web apps/email? More often than not, these users will have to call the helpdesk because they had no idea their domain passwords were going to expire. Statistics show that some of the most common calls to the helpdesk are password-related and implementing a process like the one covered here could really make a dent in your helpdesk call volume and costs.

Recently, a customer asked for some help implementing a solution for this issue based on a script they'd found on the Microsoft TechNet Script Center. The script queries the pwdLastSet attribute of user accounts in AD and the MaxPwdAge property within the domain, then does some time computations and sends an email to those users who are near a password expiration 'event.'

I thought it would make a helpful blog post to cover some of the details and considerations when implementing a solution like this. The particular script my customer found was the work of Microsoft MVP Robert Pearman and he deserves the Kudos for initially putting it together, as well as several refinements to it (including support for Fine Grained Password Policies).

DISCLAIMER:

PFEs don't normally provide code beyond sample or "proof of concept" code
The code we discuss here is an additional layer beyond code from a PFE; it is code from a Microsoft MVP resource
As with ANY code, you should always test/validate its behavior in an isolated lab
Note the script author has validated the code via his own testing on Windows Server 2008 R2. Did I mention you should test/validate the code?
If/when you're ready to deploy it to production, you should employ a solid change control process and a controlled release. This code can possibly generate emails to 100,000s of users .

You can download the script from the following link . ( https://gallery.technet.microsoft.com/Password-Expiry-Email-177c3e27 )

Click on the blue box and save the file to a workstation or member server. Obviously, a DC would work but likely isn't the best choice. The workstation or member server needs the RSAT tools for Active Directory installed. If you already have an "admin server" system where you have existing scripts, tools, Scheduled Tasks, etc., that would be a logical place for this.

Once you have downloaded the script:

Place the file in a directory on your admin server. (For this example, I will use C:\scripts)
Edit the following portions of the script as applicable using Notepad or PowerShell ISE
- $smtpServer="mail.domain.com"
 - This will be the name of your SMTP server. The admin server machine will need to be able to send using SMTP – you will likely need to work with your email team to get that process working
- $expireindays = 21
 - This is the number of days prior to password expiration that you want to notify users. The actual number of days remaining before expiration will be displayed in the email notification.
- $from = "Company Administrator <support@mycompany.com>"
 - This field can be modified to be sent from a valid email account within your environment. Consideration should be given to this address in order to prevent the perception of a phishing email as well as how replies will be handled .
- $logging = "Enabled" # Set to Disabled to Disable Logging
 - Logging is recommended to ensure that you can trace any errors that might occur
- $logFile = "C:\scripts\PasswordExpiration\pwdexp.csv"
 - This field should be changed to a desired location on the local system or network share as desired.
- $testing = "Enabled"
 - Set to Disabled to email users (configuring this to Enabled, runs a check against all accounts and sends emails ONLY the account specified in the $testRecipient field below.)
 - Configuring this to disabled actually sends emails to the users that will have their passwords expire in the configured amount of time .
 - Understand this - you risk sending out a mass-email to 10s, 100s or 10,000s of users.
 - This is automation – with great power, comes great responsibility
- $testRecipient = "someone@company.com"
 - Specifies the test user account that will receive the test email. CAUTION : This account will receive 1 email for every user the script identifies.
Save the script once you are done editing it.
Now you can test the script by running it in a lab.
1. You may need to modify the execution policy for PowerShell scripts on your admin server machine.
You should get an email that looks something like this:

From: someone@company.com [mailto:someone@company.com]
Sent: Thursday, March 23, 2015 12:52 PM
To: Someone@company.com
Subject: Your Windows password will expire in 4 days.
Importance: High

Dear someone,

Your corporate network password will expire in 4 days.

To change your password on a PC press CTRL-ALT-Delete and chose "Change Password."
It is important to ensure that you change the section of the script under $body . The message should be modified to ensure that user's don't accidentally delete the email because they suspect it is spam or a phishing email. Good inter-team collaboration and communication about this "password expiration notification process" cannot be emphasized enough.
1. Work with your helpdesk and security teams to ensure everyone signs off on this effort and approves the specific text and additional information for the email, including how to manage a 'reply' to that email address
When it all is working as desired/expected, you can disable testing:
1. $testing = "Disabled"

Now, at some pre-determined time, you or one of your staff can execute the script to generate the 'password expiry notification email' to the affected users.

For those who don't want to manually run the script, it's a simple process to create a Scheduled Task to run the script automatically.

There are numerous other ways to address this need; I have talked to many people who have developed their own processes, scripts and/or code for this. This particular process was pretty easy to implement and I was able to work with my customer to get the whole thing working in a short amount of time.

Thanks to Hilde and all the other PFE bloggers here for helping me "dip a toe" in the blog-pond (or pool?) and a special thanks to Microsoft MVP Robert Pearman who provided some insight and details around his script.

See you all next time!

Mike "CANNONBALL!" Kullish

Updated Oct 13, 2021

Version 4.0

MichaelKullish

MichaelHildebrand

Microsoft

Joined August 13, 2018

View Profile

Core Infrastructure and Security Blog

Follow this blog board to get notified when there's new activity

36 Comments

Jairon_Junior
Copper Contributor
May 27, 2024
Hi, got the script to work, thought it was all running fine, but for some reason, there's lots of users that the script is sending the email to me, instead of their emails.

I used my email for the testing, but it's disabled now.

Any idea what I could do?
Michael Kullish
Microsoft
Apr 24, 2024
jlwendt, I would suggest setting up multiple scheduled tasks. Perhaps someone else on the thread has a better way to suggest...
jlwendt
Copper Contributor
Apr 24, 2024
Is there a way to set this script to send an email in increments. For example, it sends an email letting them know the password expires in 14 days, then 7 days, then another email for when it is 3 days out?
Andrew Fitzgerald
Copper Contributor
Feb 26, 2024
I've built a portal that makes it even easier to schedule email notifications via a self service portal https://infrasos.com/active-directory-password-reset-tool-self-service-portal/
Daniel_BATM
Copper Contributor
Dec 07, 2022
Dear MichaelHildebrand
The company i work at, doesn't work on hybrid AD azure, but we do work with Office365 (E3 License's) & AD Server.
Our users not getting an email notification before their 365 password expires. Whis means when they sign in to Office 365 and their password has expired, they'll be prompted to change their password at that time without any advance notice.

Now, I spoke with Microsoft ISR support representative & sent this article, they said is ONLY relevant for hybrid azure AD.
May you please tell me if is true ? i can't believe there's no answer to our issue, i must a soulution.
I found another this kind of PS script.. please take a look.

#################################################################################################################
# Version 1.0 September 2016
# Fernando Pérez
# Based on Robert Pearman (WSSMB MVP)
#
# Script to Automated Email using Office 365 account to remind users Passwords Expiracy.
# Office 365 require SSL
# Requires: Windows PowerShell Module for Active Directory
#
#
##################################################################################################################
# Please Configure the following variables....
$smtpServer="smtp.office365.com" # Office 365 official smtp server
$expireindays = 10 # number of days for password to expire
$from = "Your email address <email address removed for privacy reasons>" # email from
$logging = "Enabled" # Set to Disabled to Disable Logging
$logFile = "c:\Scripts\PasswordChangeNotification.csv" # ie. c:\Scripts\PasswordChangeNotification.csv
$testing = "Disabled" # Set to Disabled to Email Users
$testRecipient = "email address removed for privacy reasons"
$date = Get-Date -format ddMMyyyy
#
###################################################################################################################
# Add EMAIL Function
Function EMAIL{
Param(
$emailSmtpServer = $smtpServer, #change to your SMTP server
$emailSmtpServerPort = 587,
$emailSmtpUser = "email address removed for privacy reasons", #Email account you want to send from
$emailSmtpPass = "passsword", #Password for Send from email account
$emailFrom = "email address removed for privacy reasons", #Email account you want to send from
$emailTo,
$emailAttachment,
$emailSubject,
$emailBody
)
Process{

$emailMessage = New-Object System.Net.Mail.MailMessage( $emailFrom , $emailTo )
$emailMessage.Subject = $emailSubject
$emailMessage.IsBodyHtml = $true
$emailMessage.Priority = [System.Net.Mail.MailPriority]::High
$emailMessage.Body = $emailBody

$SMTPClient = New-Object System.Net.Mail.SmtpClient( $emailSmtpServer , $emailSmtpServerPort )
$SMTPClient.EnableSsl = $true
$SMTPClient.Credentials = New-Object System.Net.NetworkCredential( $emailSmtpUser , $emailSmtpPass );

$SMTPClient.Send( $emailMessage )
}
}
# Check Logging Settings
if (($logging) -eq "Enabled")
{
# Test Log File Path
$logfilePath = (Test-Path $logFile)
if (($logFilePath) -ne "True")
{
# Create CSV File and Headers
New-Item $logfile -ItemType File
Add-Content $logfile "Date,Name,EmailAddress,DaystoExpire,ExpiresOn"
}
} # End Logging Check
# Get Users From AD who are Enabled, Passwords Expire and are Not Currently Expired
Import-Module ActiveDirectory
$users = get-aduser -filter * -properties Name, PasswordNeverExpires, PasswordExpired, PasswordLastSet, EmailAddress |where {$_.Enabled -eq "True"} | where { $_.PasswordNeverExpires -eq $false } | where { $_.passwordexpired -eq $false }
$DefaultmaxPasswordAge = (Get-ADDefaultDomainPasswordPolicy).MaxPasswordAge
# Process Each User for Password Expiry
foreach ($user in $users)
{
$Name = $user.Name
$emailaddress = $user.emailaddress
$passwordSetDate = $user.PasswordLastSet
$PasswordPol = (Get-AduserResultantPasswordPolicy $user)
# Check for Fine Grained Password
if (($PasswordPol) -ne $null)
{
$maxPasswordAge = ($PasswordPol).MaxPasswordAge
}
else
{
# No FGP set to Domain Default
$maxPasswordAge = $DefaultmaxPasswordAge
}

$expireson = $passwordsetdate + $maxPasswordAge
$today = (get-date)
$daystoexpire = (New-TimeSpan -Start $today -End $Expireson).Days

# Set Greeting based on Number of Days to Expiry.
# Check Number of Days to Expiry
$messageDays = $daystoexpire
if (($messageDays) -ge "1")
{
$messageDays = "in " + "$daystoexpire" + " days."
}
else
{
$messageDays = "today."
}
# Email Subject Set Here
$subject="Your password will expire $messageDays"

# Email Body Set Here, Note You can use HTML, including Images.
$body ="
Dear $name, 
Your Password will expire $messageDays. 
Please change your password before it expires to avoid problems accessing to your work services. 
Thanks, 
 
Dear $name, 
Su contraseña caducará en $daystoExpire días. 
Por favor cambie su contraseña antes de que ésta expire para evitar problemas al acceder a su entorno de trabajo. 
Gracias, 
 
Caro $name, 
A sua password vai expirar dentro de $daystoExpire dias 
Por favor altere a mesma antes dela expirar de forma a evitar ter problemas de acesso ao seu ambiente de trabalho. 
Obrigado, 
"

# If Testing Is Enabled - Email Administrator
if (($testing) -eq "Enabled")
{
$emailaddress = $testRecipient
} # End Testing
# If a user has no email address listed
if (($emailaddress) -eq $null)
{
$emailaddress = "email address removed for privacy reasons"
}# End No Valid Email
# Send Email Message
if (($daystoexpire -ge "0") -and ($daystoexpire -lt $expireindays))
{
# If Logging is Enabled Log Details
if (($logging) -eq "Enabled")
{
Add-Content $logfile "$date,$Name,$emailaddress,$daystoExpire,$expireson"
}
EMAIL -emailTo $emailaddress -emailSubject $subject -emailBody $body
} # End Send Message

} # End User Processing

# End
#################################################################################################################

Regards,
Daniel, IT Administrator.
email address removed for privacy reasons
Summalai
Copper Contributor
Oct 31, 2022
I've updated and tested the scripts. Please feel feel to download from here.
https://summalai.com/wp-content/uploads/2022/10/Password-Expire-Email_Public-1.txt
manu1682
Copper Contributor
Aug 24, 2022
Hi MichaelHildebrand ,

Thanks for your topic. I read it all but I want to send the email to notify expired password from workspace google. I try to run your script unsuccessfully. Please help me if I can send it from workspace google. Thanks so much.
colbyhenderson
Copper Contributor
Jun 06, 2022
Is there anyone willing to help me figure out why I can't get this script to display expires on a friendly looking date? I've added the following and thought I had it right, tested manually the variables and it shows properly but when I run this script it doesn't show the correct date.
I'm happy to send the entire script to someone but I've also copy pasted below what I did. Help please if anyone is able and willing I'd greatly appreciate it. I'm trying to have the subject line show the variable results $expirationsdatesubjectline, instead of just x number of days as the original script does. Unfortunately went out today and all those that fit the formula were told their passwords expired today 😞
$date = Get-Date -format ddMMyyyy
$dateFormat = 'MM-dd-yyy'
$messageDays = $daystoexpire
$expirationdate=(Get-Date).AddDays($daystoexpire)
$expirationdatesubjectline= Get-Date -Date $expirationdate -Format $dateFormat
Michael Kullish
Microsoft
Oct 18, 2021
Graham_Tinkers Cedrick014 Good news! The new article is live: Microsoft 365 Password Expiration Notification Email Solution for On-Premises AD Accounts - Microsoft Tech Community
Michael Kullish
Microsoft
Oct 12, 2021
I have good news. A new article will be published very soon regarding how to use O365 to send email eliminating any smtp requirements. Please stay tuned.