How to create powershell list accounts last password set 4 months and add them to an AD Group

Question

How to create powershell list accounts last password set 4 months and add them to an AD Group

ManUnderContruction 21

Hi Experts,

I am not an expert in pwoershell, and just only beginner. We have a requirement to add users to AD group named "BannedUsers" if their last password change is more than 4 months. Is this possible?

Thank you!

Bertel Andreas Harboe-Møller (00208) 0 Reputation points

2023-02-15T11:03:49.9966667+00:00
Hope this can help:

Get-Date

februar 2023 12:01:46

[datetime]::FromFileTime((Get-ADUser DRBERTEL -Properties *).pwdlastSet)

februar 2023 14:11:24

if ([datetime]::FromFileTime((Get-ADUser DRBERTEL -Properties *).pwdlastSet) -le (Get-Date).AddDays(-4)){"OK"}

if ([datetime]::FromFileTime((Get-ADUser DRBERTEL -Properties *).pwdlastSet) -le (Get-Date)){"OK"}

OK

Accepted answer

1 additional answer

Your answer

Bertel Andreas Harboe-Møller (00208) 0 Reputation points

2023-02-15T11:03:49.9966667+00:00

Hope this can help:

Get-Date

februar 2023 12:01:46

[datetime]::FromFileTime((Get-ADUser DRBERTEL -Properties *).pwdlastSet)

februar 2023 14:11:24

if ([datetime]::FromFileTime((Get-ADUser DRBERTEL -Properties *).pwdlastSet) -le (Get-Date).AddDays(-4)){"OK"}

if ([datetime]::FromFileTime((Get-ADUser DRBERTEL -Properties *).pwdlastSet) -le (Get-Date)){"OK"}

OK

Answer 1

Rich Matheisen 47,901

This might be what you're looking to do:

$BanMeDate = (Get-Date).Date.AddMonths(-4)  
  
Get-ADUser -Filter * -Properties PwdLastSet  |  
    ForEach-Object{  
        if ([DateTime]::FromFileTime($_.PwdLastSet) -le $BanMeDate){  
            Add-ADGroupMember -Identity BannedUsers -Members $_.SamAccountName -WHATIF  
        }  
    }

Be sure you TEST THIS! When you're satisfied that it isn't going to destroy your organization, remove the "-WHATIF" parameter.

Answer 2

ManUnderContruction 21

Thanks @Rich Matheisen , I tried it out but it seems there's issue with the integer conversion, getting the error as per below:

Could not compare "133146771438393590" to "08/06/2022 00:00:00". Error: "Cannot convert value "8/6/2022 12:00:00 AM" to type "System.Int64". Error: "Invalid cast from 'DateTime' to 'Int64'.""
At line:5 char:14

if ($_.PwdLastSet -le $BanMeDate){
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
CategoryInfo : InvalidOperation: (:) [], RuntimeException
FullyQualifiedErrorId : ComparisonFailure

Rich Matheisen 47,901 Reputation points

2022-12-06T02:59:26.277+00:00

Oops. Sorry! I forgot that the value is a "File time", not a regular DateTime object.

I corrected the code I posted earlier to make the conversion.
ManUnderContruction 21 Reputation points

2022-12-06T07:10:04.29+00:00

Thank you @Rich Matheisen !! You're awesome, if it will not bother you, I forgot to set additional parameters, I only want to restrict those accounts that are not in "ADMINISTRATORS", "DOMAIN ADMINS" "ENTERPISE ADMINS"group , and account "Password do not expires" is not enabled. Thank you!! :)
Rich Matheisen 47,901 Reputation points

2022-12-07T03:20:36.39+00:00

Create a new thread. This one has already been marked as having been answered.

Share via

How to create powershell list accounts last password set 4 months and add them to an AD Group

1 additional answer

Your answer