similar to: Get PasswordMustChangeNow parameter from command line

Perfect, I got the parameter I needed! I just checked for `msDS-UserPasswordExpiryTimeComputed`, and if it's 0, then I know the password needs to change on the next login! Thanks! I honestly had no idea what the attributes were, but now I see they're the attributes that are in Active Directory. On Wed, Jan 23, 2019 at 11:19 AM Rowland Penny via samba < samba at lists.samba.org>

On Wed, 23 Jan 2019 10:44:01 -0800 Luke Barone via samba <samba at lists.samba.org> wrote: > I am adapting a script that needs to know whether a user needs to > change their password on the next login from NT to AD with Samba. > > I have tried "samba-tool user getpassword <user> --attributes > PwdMustChangeNow", but that's not giving me anything useful -

Mandi! Andrew Bartlett via samba In chel di` si favelave... > It is an operational attribute. simply add  > msDS-UserPasswordExpiryTimeComputed > to the list of attributes requested when searching for the user. root at vdcsv1:~# ldbsearch -H /var/lib/samba/private/sam.ldb -b "dc=ad,dc=fvg,dc=lnf,dc=it" -s base "" maxPwdAge # record 1 dn:

On Fri, 27 Oct 2017 07:17:56 +1300 Andrew Bartlett <abartlet at samba.org> wrote: > On Thu, 2017-10-26 at 09:26 +0100, Rowland Penny via samba wrote: > > On Thu, 26 Oct 2017 13:25:00 +1300 > > Andrew Bartlett <abartlet at samba.org> wrote: > > > > > On Tue, 2017-10-24 at 18:13 +0100, Rowland Penny via samba wrote: > > > > > > > >

On Fri, 27 Oct 2023 23:48:22 +0200 Kees van Vloten via samba <samba at lists.samba.org> wrote: > Hi Team, > > Is it possible to make a LDAP-query that returns whether an account > is expired or not? > > I am aware that it is possible to do the maths against the > "accountExpires" attribute, but that requires some scripting around > the query. > >

Op 28-10-2023 om 09:37 schreef Rowland Penny via samba: > On Fri, 27 Oct 2023 23:48:22 +0200 > Kees van Vloten via samba <samba at lists.samba.org> wrote: > >> Hi Team, >> >> Is it possible to make a LDAP-query that returns whether an account >> is expired or not? >> >> I am aware that it is possible to do the maths against the >>

On Mon, 23 Oct 2017 16:52:05 +0200 Marco Gaiarin via samba <samba at lists.samba.org> wrote: > > Sorry, i came back on this, but: > > > In another, more generic, way: how password policies are enforced? > > still i need an answer on this question. > > > I've done some tests, using my account, that pdbedit say: > > root at vdcsv1:~# LANG=C

On Sat, 28 Oct 2023 11:54:34 +0200 Kees van Vloten via samba <samba at lists.samba.org> wrote: > > Op 28-10-2023 om 09:37 schreef Rowland Penny via samba: > > On Fri, 27 Oct 2023 23:48:22 +0200 > > Kees van Vloten via samba <samba at lists.samba.org> wrote: > > > >> Hi Team, > >> > >> Is it possible to make a LDAP-query that returns

On Wed, 28 Mar 2018 20:14:00 +1300 Andrew Bartlett <abartlet at samba.org> wrote: > > On Wed, 2018-03-28 at 03:09 -0400, Mark Foley via samba wrote: > > > > Actually, that didn't quite work. It did change the domain password, but didn't reset the > > expiration days. So today, when the previous password was set to expire. My account was locked > > out.

This seems to work for maxPwdAge ldapsearch -LLL -Q -s base -h ad.mydomain.tld -b dc=ad,dc=mydomain,dc=tld maxPwdAge now I just need to query a users pwdLastSetq I tried the commands above but am not getting anything. I tried looking at the ungrepped output but I don't see how to link the pwdLastSet with any user. I get a long list. I think I'm looking for dn: and a matching pwdLastSet?

Hi Team, Is it possible to make a LDAP-query that returns whether an account is expired or not? I am aware that it is possible to do the maths against the "accountExpires" attribute, but that requires some scripting around the query. - Kees.

On Tue, 24 Oct 2017 18:37:09 +0200 Marco Gaiarin via samba <samba at lists.samba.org> wrote: > Mandi! Rowland Penny via samba > In chel di` si favelave... > > > The main problem here is that you are still looking at the problem > > from the NT perpective, > > Seems obvious to me. I came from 10+ years of experience on Samba3 NT > domains, that indeed had

Hi list, long time no see! :) I was looking for an email reminder script for users whose password will expire. Some of our users are on long travels and will never see the Domain's default notification. I haven't found any complete (and simple) solution online. So I wrote one. In case it helps anyone, you find it below. You should only have to fill in the blanks for the the

On Tue, 27 Mar 2018 13:38:56 -0400 Mark Foley wrote: > > On Mon, 26 Mar 2018 08:08:53 +0200 Michael Wandel <m.wandel at t-online.de> wrote: > > > > Am 26.03.2018 um 06:31 schrieb Mark Foley via samba: > > > As a normal user, I want to change my Domain Password. I've tried: > > > > > > $ samba-tool user setpassword myuserId

On Fri, 30 Mar 2018 20:19:02 -0400 Mark Foley via samba <samba at lists.samba.org> wrote: > > On Wed, 28 Mar 2018 20:14:00 +1300 Andrew Bartlett > > <abartlet at samba.org> wrote: > > > > > > On Wed, 2018-03-28 at 03:09 -0400, Mark Foley via samba wrote: > > > > > > > > Actually, that didn't quite work. It did change the

Hi every one: I'm using samba4 as domain controller and a I want to check every 1 hour in my mail server the password expiration for every user in the domain. I need to kow what is the attribute used in samba4. Using ldbsearch i see badPasswordTime and accountExpires, but in the microsoft documentation said that accountExpires is used for represent the date when the account expires. Can i use

On Wed, 8 Feb 2017 18:32:15 +0100 Ole Traupe via samba <samba at lists.samba.org> wrote: > That was weird: didn't see (expect) there to be a discussion right on > the same topic going on at this very moment. > > Ole > > > On 08.02.2017 17:37, Ole Traupe via samba wrote: > > Hi list, > > > > long time no see! :) > > > > I was looking

Hi, Thank you for this answer, unfortunately I was not able to re-hash password as they are hashed into LDB database. First I retrieved the hash: ldbsearch -H $sam '(cn=some user)' unicodePwd # record 1 dn: CN=some user,OU=Users Management,DC=ad,DC=example,DC=com unicodePwd:: COwwLgiqqaHRyhy4HxWp4A== This "unicodePwd" attribute comes from a quick search into "user"

I am running this on a CentOS 6.7 DC with Samba version 4.2.5. Ole On 09.02.2017 13:40, Ole Traupe via samba wrote: > Actually, there were 2 problems. These lines work for me: > > #user=$(echo "${user}" | awk -F '\\' '{print $2}') > user_expire_date=$(ldbsearch --url="${LDBDB}" -b "${domainDN}" -s > sub >

On Sun, 26 Mar 2017 00:16:13 -0400 Mark Foley via samba <samba at lists.samba.org> wrote: > > ldbsearch --url="/var/lib/samba/private/sam.ldb" -b > "DC=hprs,DC=local" -s sub > "(&(objectCategory=person)(objectClass=user)(sAMAccountName=mark))" > msDS-UserPasswordExpiryTimeComputed > > returns 0 records. Certainly because the --url