Powershell - Test user credentials in AD, with password reset

Question

I can successfully use Powershell to tell if a user authenticates in Active Directory:

Function Test-ADAuthentication {
    param($username,$password)
    (new-object directoryservices.directoryentry "",$username,$password).psbase.name -ne $null
}

Test-ADAuthentication "test" "Password1"

However, I cannot for the life of me figure out how to:

Check if the password needs to be reset, while
Verifying the credentials sent did work on their last password.

How could one go about this?

somewhat better solution to the same problem here: http://stackoverflow.com/questions/7663219/how-to-authenticate-an-user-in-activedirectory-with-powershell — Nick Kavadias, Jul 13 '15 at 08:10

score 12 · Accepted Answer · edited Dec 29 '14 at 02:22

12

Credentials can be tested by running a process. An example below,

Start-Process -FilePath cmd.exe /c -Credential (Get-Credential -UserName $username -Message 'Test Credential')

Or simply:

Start-Process -FilePath cmd.exe /c -Credential (Get-Credential)

You will be presented with a prompt to enter a password. If you need read the password from a string (bad practice), you need to initialize the credential object beforehand. More details on that method can be found in the help.

Get-Help Get-Credential

edited Dec 29 '14 at 02:22

Community

1

answered May 20 '14 at 16:35

MFT

400
2
9

1

You might find this start-process will not work anyway if the user does not have remoting rights.... I found the answers here helpful. https://serverfault.com/questions/276098/check-if-user-password-input-is-valid-in-powershell-script – andrew pate Jan 03 '20 at 15:27

score 0 · Answer 2 · answered Mar 14 '23 at 14:37

Here's a way to get the remaining days for a given user before they password expires:

(([datetime]::FromFileTime((Get-ADUser user -Properties "msDS-UserPasswordExpiryTimeComputed")."msDS-UserPasswordExpiryTimeComputed")) - (Get-Date)).TotalDays

If the number is 0 or negative, then the password has expired.

This command will check if the user account is locked:

(Get-ADUser user -Properties LockedOut).LockedOut

As for the second question - if I understand correctly you want to see if their currently entered password is the same as the previously used one.

This is not possible as far as I know - with certain policies AD can keep record of previous passwords, but they are not exposed for external access.

Powershell - Test user credentials in AD, with password reset

2 Answers2

Linked