• State Suggested Answer
  • Replies 9 replies
  • Answers 1 answer
  • Subscribers 62 subscribers
  • Views 2925 views
  • Users 0 members are here
Options
Related

Reset Passwords for users in a specific OU

umang anand
over 1 year ago

Hi There

we have a new HR system that is using Powershell to Create users. Unfortunately, this does not output the passwords so we cannot send them to the managers.

Is there a way to reset the passwords for any users that get created in this OU using a generic password?

I have got a script that generates a password, I cant seem to get it to Reset the users password.

$Users = get-qaduser -SizeLimit 10000 -SearchRoot 'ou=new users,dc=test,dc=Local' -IncludedProperties DisplayName, SamAccountName

function Get-RandomPassword {
$length = 10
$characters = 'abcdefghkmnprstuvwxyzABCDEFGHKLMNPRSTUVWXYZ'
$nonchar = '123456789!$%&?#'
$random = 1..$length | ForEach-Object { Get-Random -Maximum $characters.length }
$random2 = 1..2 | ForEach-Object { Get-Random -Maximum $nonchar.length }
$private:ofs= ""
$ThePassword = [string]$characters[$random] + [string]$nonchar[$random2]
return $ThePassword
}

function Reset-ADPassword {
foreach ($User in $Users) {
$Username = $User.SamAccountName
$DisplayName = $User.DisplayName
$Password = Get-RandomPassword

Write-Host $DisplayName / $Username / $Password
Set-ADAccountPassword -id $username -NewPassword (ConvertTo-SecureString -AsPlainText $Password -Force)
}

Parents
  • 0 over 1 year ago

    Do you have Active Roles in your environment or is this purely a scripting question?  No problem if you don't - just want to make sure that I address the issue in a manner that makes sense for your environment.

  • 0 over 1 year ago in reply to JohnnyQuest

    Thank for the quick Reply, 

    We have Active Roles at the moment, but due to the New HR system, I have a separate server in Dev to test a few changes we have to do as part of this.

  • 0 over 1 year ago in reply to umang anand

    Is your new HR system provisioning directly into AD (and bypassing Active Roles)?

    If yes, then what you could do is implement code something like you have above in the form of a onPostCreate handler.

    This would be included in a policy script which you would include in a provisioning policy.

    The concept is covered here in the documentation.

    The code for the policy script would look something like this:

    function Get-RandomPassword {
    $length = 10
    $characters = 'abcdefghkmnprstuvwxyzABCDEFGHKLMNPRSTUVWXYZ'
    $nonchar = '123456789!$%&?#'
    $random = 1..$length | ForEach-Object { Get-Random -Maximum $characters.length }
    $random2 = 1..2 | ForEach-Object { Get-Random -Maximum $nonchar.length }
    $private:ofs= ""
    $ThePassword = [string]$characters[$random] + [string]$nonchar[$random2]
    return $ThePassword
    }

    function OnPostCreate ($Request) {

    # Is the detected create event for a user object?
    # If not, then don't run the rest of the script

    If ($Request.class -ne "user"){return}

    # Get the distinguishedname (DN) of the just created user

    $InProcessUser = $Request.DN

    # Generate a password for the new user

    $Password = Get-RandomPassword

    # Bind to the user via Active Roles - EDMS means the call is going through Active Roles

    $NewUserObj = [ADSI]"EDMS://$InProcessUser"

    # Set the Active Roles user password property

    $NewUserObj.Properties["edsaPassword"].Value = $Password
    $NewUserObj.CommitChanges()

    # Add some code here to send the new password (stored in $Password) to the Manager

    } # End of onPostCreateHandler

    This article explains the concept of detecting changes made outside of Active Roles.

  • 0 over 1 year ago in reply to JohnnyQuest

    Thank you. I will try this & get back to you.

Reply Children
No Data