16 lines
976 B
PowerShell
16 lines
976 B
PowerShell
Import-Module ActiveDirectory
|
|
$u = Get-ADUser 'a.vallejo' -Properties MemberOf, Enabled, PasswordLastSet, LockedOut, PasswordExpired
|
|
Write-Output "Enabled: $($u.Enabled) LockedOut: $($u.LockedOut) PwExpired: $($u.PasswordExpired)"
|
|
Write-Output "PwLastSet: $($u.PasswordLastSet)"
|
|
Write-Output "UPN: $($u.UserPrincipalName)"
|
|
Write-Output "Groups:"
|
|
$u.MemberOf | ForEach-Object { Write-Output " $_" }
|
|
# Check if ChangePasswordAtLogon is set (would block login)
|
|
$raw = Get-ADUser 'a.vallejo' -Properties pwdLastSet
|
|
if ($raw.pwdLastSet -eq 0) { Write-Output "WARNING: ChangePasswordAtLogon=TRUE (pwdLastSet=0)" }
|
|
# Validate credential against DC
|
|
Add-Type -AssemblyName System.DirectoryServices.AccountManagement
|
|
$ctx = New-Object System.DirectoryServices.AccountManagement.PrincipalContext([System.DirectoryServices.AccountManagement.ContextType]::Domain, "cascades.local")
|
|
$valid = $ctx.ValidateCredentials("a.vallejo", "Sunrise4827")
|
|
Write-Output "Password validates: $valid"
|