Re: Welcome to PowerShell for Active Directory forum

Aleksandar — Wed, 27 Oct 2010 05:00:00 GMT

If you have Windows Server 2008 R2 with Active Directory Domain Services role (and promoted to a domain controller) or a downlevel server with Active Directory Management Gateway Service (ADWS for Windows Server 2003 and Windows Server 2008), the easist way to change the default domain password policy is to use the Set-ADDefaultDomainPasswordPolicy cmdlet.

First we need to load Active Directory module:

PS C:\> Import-Module ActiveDirectory

Let's check the default domain password policy before a change:

PS C:\> Get-ADDefaultDomainPasswordPolicy -Identity test.local
ComplexityEnabled           : True
DistinguishedName           : DC=test,DC=local
LockoutDuration             : 00:30:00
LockoutObservationWindow    : 00:30:00
LockoutThreshold            : 0
MaxPasswordAge              : 42.00:00:00
MinPasswordAge              : 1.00:00:00
MinPasswordLength           : 7
objectClass                 : {domainDNS}
objectGuid                  : cf3b61ee-1a03-410e-9ecb-d5de33ea52ac
PasswordHistoryCount        : 24
ReversibleEncryptionEnabled : False

This will set the default domain password policy for the current logged on user domain:

PS C:\> Get-ADDefaultDomainPasswordPolicy -Current LoggedOnUser | Set-ADDefaultDomainPasswordPolicy -LockoutDuration 00:40:00 -LockoutThreshold 3

Let's check the result:

PS C:\> Get-ADDefaultDomainPasswordPolicy | Format-List lockout*
LockoutDuration : 00:40:00
LockoutObservationWindow : 00:30:00
LockoutThreshold : 3

Success. :)

When Active Directory is not an option, and you need to use [ADSI] type accelerator, the following steps are the easiest:

# connect to a current domain; for a change, we'll use WinNT moniker
PS C:\> $domain = [ADSI]"WinNT://$env:userdomain"

# set lockout threshold value
PS C:\> $domain.MaxBadPasswordsAllowed = 0

# set lockout duration value (in seconds)
PS C:\> $domain.AutoUnlockInterval = 1800

# commit the changes to Active Directory; we need access to a raw object to expose CommitChanges method, therefore we use psbase property
PS C:\> $domain.psbase.commitchanges()

Pipe $domain and $domain.psbase to Get-Member cmdlet to see the difference. $domain.psbase offers much more. :)

Hope this helps,
@alexandair

Search results for '(app:forums OR groupid:24)' matching tags 'Active Directory' and 'Set-ADDefaultDomainPasswordPolicy'

Re: Welcome to PowerShell for Active Directory forum