Get all users that cannot change their password
Earlier today a colleague of mine asked me for a script solution:
"I want to get all users that cannot change their password from Active Directory but I can't find any attribute on the user account with that info."
Correct, there is no such attribute. When a user account is set with the 'User cannot change password' account option, two (Deny) Access Control Entries (ACEs) are added to the account in question:
1. Deny for the user account (SELF)
2. Deny for everyone else (Everyone built-in group)
To see the ACEs go to the 'Security' tab and then click the 'Advanced' button:
With Quest AD Cmdlets you can get all users that cannot change their password from your active directory domain with a simple one-liner, lets start by querying just one user:
PS > Get-QADPermission -Identity user1 -Deny -ExtendedRight User-Change-Password `
-Account everyone,self
Permissions for: domain/TEST/Users/User1
Ctrl Account Rights Source AppliesTo
---- ------- ------ ------ ---------
Deny Everyone Change Password Not inherited This object only
Deny NT AUTHORITY\SELF Change Password Not inherited This object only
WARNING: Only explicit permissions were displayed. To display inherited and AD
default permissions use -Inherited and -SchemaDefault switches respectively.
As you can see User1, and 'Everyone' group members, cannot change the password. Notice that we get a yellow warning, we can suppress warnings by adding the -WarningAction parameter with a value of SilentlyContinue (currently, we cannot suppress the green messages).
To get all users we start by asking Get-QADUser to get ALL (-SizeLimit 0) Enabled user accounts (-Enabled) and then we filter the results by calling the same Get-QADPermission command we executed above inside Where-Object, only now we change the user Identity (User1) with the current pipeline object ($_):
Get-QADUser -Enabled -SizeLimit 0 | Where-Object { Get-QADPermission -Identity $_ -Deny -ExtendedRight User-Change-Password -Account everyone,self -WarningAction SilentlyContinue }
EDIT
: See the comments for this post below If you get an error for the -WarningAction parameter.