JSI Tip 8294. How can I return the domain password policy attributes?

Jerold Schulman

July 25, 2004

1 Min Read
ITPro Today logo in a gray background | ITPro Today

I have scripted PassPolicy.bat and PassPolicy.vbs to return the following domain's password policy attributes:

minPwdLengthpwdPropertiespwdHistoryLength minPwdAge maxPwdAgelockoutThreshold lockoutDuration LockoutWindow

The syntax for using PassPolicy.bat is:

call PassPolicy minPwdLength pwdProperties pwdHistoryLength minPwdAge maxPwdAge lockoutThreshold lockoutDuration LockoutWindow

where each argument is a call directed environment variable that will contain the value of the policy setting.

NOTE: PassPolicy.bat and PassPolicy.vbs must be located in the same folder.

PassPolicy.bat contains:

@echo offif {%8}=={} @echo syntax PassPolicy minPwdLength pwdProperties pwdHistoryLength minPwdAge maxPwdAge lockoutThreshold lockoutDuration LockoutWindow&goto :EOFfor /f "Tokens=1-8" %%a in ('cscript //NOLOGO %~dp0PassPolicy.vbs') do ( set %1=%%a set %2=%%b set %3=%%c set %4=%%d set %5=%%e set %6=%%f set %7=%%g set %8=%%h)


PassPolicy.vbs contains:

Option ExplicitDim objRootDSE, strDNSDomain, objDomainDim objMinPWAge, retMinPWAgeDim objMaxPWAge, retMaxPWAgeDim objDuration, retDurationDim objLockoutWin, retLockoutWinSet objRootDSE = GetObject("LDAP://RootDSE")strDNSDomain = objRootDSE.Get("defaultNamingContext")Set objDomain = GetObject("LDAP://" & strDNSDomain)Set objMinPWAge = objDomain.minPwdAgeretMinPWAge = Int8ToSec(objMinPWAge) / (24 * 60 * 60)Set objMaxPWAge = objDomain.maxPwdAgeretMaxPWAge = Int8ToSec(objMaxPWAge) / (24 * 60 * 60)Set objDuration = objDomain.lockoutDurationretDuration = Int8ToSec(objDuration) / (60)Set objLockoutWin = objDomain.lockoutObservationWindowretLockoutWin = Int8ToSec(objLockoutWin) / (60)Wscript.Echo objDomain.minPwdLength & " " & objDomain.pwdProperties & " " & objDomain.pwdHistoryLength & " " & retMinPWAge & " " & retMaxPWAge & " " & objDomain.lockoutThreshold & " " & retDuration & " " & retLockoutWin' I found the Int8ToSec function on the WebFunction Int8ToSec(objInt8)' Function to convert Integer8 attributes from' 64-bit numbers to seconds.  Dim retHigh, retLow  retHigh = objInt8.HighPart' Account for error in IADsLargeInteger property methods.  retLow = objInt8.LowPart  If retLow 


Sign up for the ITPro Today newsletter
Stay on top of the IT universe with commentary, news analysis, how-to's, and tips delivered to your inbox daily.

You May Also Like