JSI Tip 8294. How can I return the domain password policy attributes?
Jerold Schulman
July 25, 2004
1 Min Read
I have scripted PassPolicy.bat and PassPolicy.vbs to return the following domain's password policy attributes:
minPwdLengthpwdPropertiespwdHistoryLength minPwdAge maxPwdAgelockoutThreshold lockoutDuration LockoutWindow
The syntax for using PassPolicy.bat is:
call PassPolicy minPwdLength pwdProperties pwdHistoryLength minPwdAge maxPwdAge lockoutThreshold lockoutDuration LockoutWindow
where each argument is a call directed environment variable that will contain the value of the policy setting.
NOTE: PassPolicy.bat and PassPolicy.vbs must be located in the same folder.
PassPolicy.bat contains:
@echo offif {%8}=={} @echo syntax PassPolicy minPwdLength pwdProperties pwdHistoryLength minPwdAge maxPwdAge lockoutThreshold lockoutDuration LockoutWindow&goto :EOFfor /f "Tokens=1-8" %%a in ('cscript //NOLOGO %~dp0PassPolicy.vbs') do ( set %1=%%a set %2=%%b set %3=%%c set %4=%%d set %5=%%e set %6=%%f set %7=%%g set %8=%%h)
PassPolicy.vbs contains:
Option ExplicitDim objRootDSE, strDNSDomain, objDomainDim objMinPWAge, retMinPWAgeDim objMaxPWAge, retMaxPWAgeDim objDuration, retDurationDim objLockoutWin, retLockoutWinSet objRootDSE = GetObject("LDAP://RootDSE")strDNSDomain = objRootDSE.Get("defaultNamingContext")Set objDomain = GetObject("LDAP://" & strDNSDomain)Set objMinPWAge = objDomain.minPwdAgeretMinPWAge = Int8ToSec(objMinPWAge) / (24 * 60 * 60)Set objMaxPWAge = objDomain.maxPwdAgeretMaxPWAge = Int8ToSec(objMaxPWAge) / (24 * 60 * 60)Set objDuration = objDomain.lockoutDurationretDuration = Int8ToSec(objDuration) / (60)Set objLockoutWin = objDomain.lockoutObservationWindowretLockoutWin = Int8ToSec(objLockoutWin) / (60)Wscript.Echo objDomain.minPwdLength & " " & objDomain.pwdProperties & " " & objDomain.pwdHistoryLength & " " & retMinPWAge & " " & retMaxPWAge & " " & objDomain.lockoutThreshold & " " & retDuration & " " & retLockoutWin' I found the Int8ToSec function on the WebFunction Int8ToSec(objInt8)' Function to convert Integer8 attributes from' 64-bit numbers to seconds. Dim retHigh, retLow retHigh = objInt8.HighPart' Account for error in IADsLargeInteger property methods. retLow = objInt8.LowPart If retLow
About the Author
Sign up for the ITPro Today newsletter
Stay on top of the IT universe with commentary, news analysis, how-to's, and tips delivered to your inbox daily.
You May Also Like