PowerShell: Email Users with Expiring Passwords

# PasswordExpirationNotification.ps1
# Description:
# This script performs the following tasks
# a. Query Active Directory for a list of enabled users
# b. Email users basing on their password expiration dates by comparing to provided thresholds

# User input variables

function passwordExpirationNotification{
    function generateEmailContent{
        $days=if ($expireDays -le 0) {
                "<strong style='color: red;'>TODAY</strong>"
            }elseif($expireDays -le [int]$thresholds[1]){
                "in <font color=`"red`"><b>$expireDays days</b></font>"
            }elseif ($expireDays -le [int]$thresholds[2]) {
                "in <b>$expireDays days</b>"
                "in $expireDays days"
        return "
        <h3>Hello $name,</h3>
        <p>This email is a reminder that your <a href='#' style='text-decoration:none; color:#000'>$domain</a> password will expire in $days. Pleaes udpate it by following these options:</p>
        <h3>1. Use the password management tool:</h3>
            <li>While connected to VPN or direct-access to the company network, go to the following website using any browser: <a href='$authurl'>Self Service Password Portal</a></li>
            <li>Click on 'Sign In'</li>
            <li>Select the drop-down menu that corresponds: <a href='#' style='text-decoration:none; color:#000'>$($domain.toupper())</a> </li>
            <li>Enter your username (example: 'jdoe')</li>
            <li>Provide your existing password</li>
            <li>Click 'Sign in'</li>
            <li>If there are additional screens, follow that acccount setup wizard</li>
            <li>Proceed to the Main Menu and click the 'Change Password' button</li>
            <li>Enter a new password twice</li>
            <li>Click 'Change Password'</li>
        <h3>2. If you experience difficulties with the method above, contact our Help Desk for assistance</h3>
            <li><b>Phone:</b> $helpdeskPhone $businessHours</li>
            <li><b>Email:</b> $emailFrom</li>
    $domainObject=.{try{get-addomain -Server $jumpBox}catch{$false}}
    if (!$domainObject){break}
    $maxThreshold=($thresholds | Measure-Object -Maximum).Maximum
    $accounts = Get-ADUser -Server $pdcEmulator `
        -filter {Enabled -eq $true -and PasswordNeverExpires -ne $True -and PasswordExpired -ne $True} `
        -properties Name,Mail,PasswordLastSet,"msDS-UserPasswordExpiryTimeComputed"| `
        Where-Object{$null -ne $_.PasswordLastSet -AND $null -ne $_.Mail}                                                                                                                                                                                                                                                                                                                                                                                          
    foreach ($account in $accounts) {  
    # The largest possible 64-bit value (2^63-1 = 9223372036854775807)
    # This value in property msDS-UserPasswordExpiryTimeComputed means that PasswordNeverExpires is true
    $passwordExpiration=if ($expiration -ne $max64BitValue){
    [int]$daysDifference = (new-timespan $today $passwordExpiration).TotalDays
    [string]$name = $account.Name
    [string]$emailTo = $account.Mail
    write-host "Name: $name Email: $emailTo Password expires in: $daysDifference days..."
    if ($daysDifference -le $maxThreshold -and $daysDifference -ge 0){        
        write-host "Password of $name expires in: $daysDifference days. Email would be sent to: $emailTo"
        $emailContent=generateEmailContent $name $emailTo $daysDifference $domain $authUrl $thresholds $emailFrom $helpdeskPhone $businessHours
            Send-MailMessage -from "$emailFrom" -To "$emailTo" -subject "Password expiration notice" -bodyashtml $emailContent -smtpServer $emailRelay
            write-warning $_

passwordExpirationNotification $jumpBox $emailFrom $emailRelay $authUrl $thresholds $helpdeskPhone $businessHours

Leave a Reply

Your email address will not be published. Required fields are marked *