Not sure how many people out there have this problem, but many of our users rarely log off of their machines. This is a problem in an environment that has Mac's bound to Active Directory which need to abide by certain password expiration policies. Essentially, if a user doesn't log off or reboot, they don't get the notification that their password is going to expire and then eventually end up with a locked account.
There are a lot of different ways to handle this kind of issue, here are a few I can think of of the top of my head:
- Use Casper to Force log off / reboot machines at set intervals
- Utilize a script in Casper to kick of an email notification to the user
- Write an Applescript that prompts a user to change their password if it detects certain parameters
Using Casper, we were looking for a more elegant solution than a brute force log off (option 1). And we know from experience with a few other systems that email notifications about passwords expiring are frequently ignored (option 2). So that led me to the third option.
Those of us that have to deal with the Windows world (though I try to avoid it) know that Windows 7 has a nice little balloon that pops up above the system try by your clock which notifies you when your AD password is getting close to expiring.
I wanted something that would be as elegant as that (maybe leveraging Growl notifications). I have seen the ADPassMon application and unfortunately that does not work in our environment (we have a rather odd AD configuration). I also didn't like that it just put a countdown of the days until your password expires in the menu bar.
So I decided to write something myself (with the help of a few other code snippets out there). If anyone else has this issue, feel free to take a look at what I have below. We'll be rolling this out later this year for our users (so if you use any parts of it, make sure to test it throughly in your environment). I have some comments in the code explaining what each part of the script does, but in summary, it prompts a user if their password is going to expire in less than 14 days then offers them a dialog to change the password. When they click the button, it launches System Preferences and goes right to the "Change Password" section under the "Accounts" pane.
Also, if anyone has any comments about how they are handling this in their environment, I'd love to hear them. As well as any suggestions to make the script better. It's far from perfect, but I wanted to get it out on the forums in the event it might help some other people deal with this issue as well.
# Password Expiration Script
# Written By: Pete Johnson with some help from the following sources:
# https://secure.macscripter.net/viewtopic.php?pid=112613
# http://hints.macworld.com/article.php?story=20060925114138223
# Date: 05/30/2012
# Description: Uses DSCL to query how many days are left until a users password expires and prompts the user to change it if less than 14 days.
# This script is designed to be called from a Casper policy once per day. Compile the script then deploy it to a Shared location on each machine.
# Then create a daily policy in Casper to run a command that runs the script
# Prequisite: Access for Assistive Devices must be enabled for this script to launch System Preference properly.
# Password Expiration Policy in days (typically 90, I chose 89 to make sure the user changes it before the password expires on the 90th day)
set pwPolicy to "89"
# Prompt user if password expires in less than 14 days
set pwNotification to "14"
# Get logged in user
set user to do shell script "whoami"
if user is not "admin" then
# Query Directory Service and get cryptic password last set value. This may be called pwdLastSet in most cases. In ours it was SMBPasswordLastSet. set lastpwdMS to do shell script "dscl localhost -read /Search/Users/" & user & " grep -i SMBPasswordLastSet | cut -d ' ' -f 2 | sed q"
# Get the current date in Unix so we can calculate how many days are left set todayUnix to do shell script "date "+%s""
# First part of formula to decode password last set value from directory service. set lastpwdUnix to do shell script "expr " & lastpwdMS & " / 10000000 - 11644473600"
# Subtract that value from todays date set diffUnix to do shell script "expr " & todayUnix & " - " & lastpwdUnix
# Convert to days set diffdays to do shell script "expr " & diffUnix & " / 86400"
# Subtract password policy from days to get our final value set passwordExpiration to do shell script "expr " & pwPolicy & " - " & diffdays
if passwordExpiration is less than pwNotification then tell application "System Events" activate # Prompt a user to change their password if there is less than 14 days remaining. If this value is less than 14, script will exit gracefully without prompting user. display dialog "Your network password will expire in less than " & passwordExpiration & " days." buttons {"Change Now", "Change Later"} default button 1 with title "Network Password Expiration" with icon caution
# If user elects to change their password, this section will bring up System Preferences -> Accounts and launch the change password dialog. if result = {button returned:"Change Now"} then tell application "Finder" # Check version number of OS. This is important for when we call the System Preferences pane, the commands are slightly different depending # on OS version set os_version to version
# Parse out OS Version value so it's just the first four characters (eg. 10.6, 10.7, 10.8) set os_version_clean to do shell script "echo " & os_version & " | sed 's/(.*)../\\1/'" end tell tell application "System Preferences" activate # Launch System Preferences and go into the "Accounts / Users" pane reveal anchor "passwordPref" of pane id "com.apple.preferences.users" end tell tell application "System Events" tell process "System Preferences" if os_version_clean is "10.7" then # In version 10.7 and 10.8 the Accounts pane was renamed to "Users & Groups". This will click the "Change Password" button. click button "Change Password…" of tab group 1 of window "Users & Groups" end if if os_version_clean is "10.6" then # In version 10.6 this will click the Change Password button. click button "Change Password…" of tab group 1 of window "Accounts" end if
end tell
end tell
end if
end tell
end if
end if
