Kill Your Password Reset Tickets — Email Users Before They Expire

C:\Scripts\PasswordExpiryNotify.ps1

# Password Expiry Notification System
# Automate & Operate — automateandoperate.com

Import-Module ActiveDirectory

# Email settings — update these
$from = "[email protected]"
$adminTo = "[email protected]"
$smtpServer = "your.smtp.server"
$smtpPort = 587
$username = "[email protected]"
$password = ConvertTo-SecureString "yourpassword" -AsPlainText -Force
$credential = New-Object System.Management.Automation.PSCredential($username, $password)

$logFile = "C:\Logs\PasswordExpiryNotify.log"
$reportFile = "C:\Logs\PasswordExpiryReport.csv"

# Days remaining that trigger a user email
$notifyDays = @(14, 7, 3, 1)

# Set to $true for a dry run — logs and reports but sends NO user emails
$testMode = $true

# Your company name for the user email
$companyName = "Your Company"

# Create log folder if missing
if (-not (Test-Path "C:\Logs")) {
    New-Item -ItemType Directory -Path "C:\Logs"
}

$timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
$report = @()
$notifiedCount = 0
$skippedNoEmail = @()

# Get the domain default max password age
$maxPasswordAge = (Get-ADDefaultDomainPasswordPolicy).MaxPasswordAge.Days

if ($maxPasswordAge -eq 0) {
    Add-Content -Path $logFile -Value "$timestamp — ABORTED: Domain policy has no password expiry set"
    return
}

Add-Content -Path $logFile -Value "$timestamp — START — Max password age: $maxPasswordAge days — TestMode: $testMode"

# Get all enabled users whose passwords actually expire
$users = Get-ADUser -Filter {
    Enabled -eq $true -and PasswordNeverExpires -eq $false
} -Properties PasswordLastSet, EmailAddress, DisplayName, PasswordExpired

foreach ($user in $users) {

    # Skip accounts that have never had a password set
    if ($null -eq $user.PasswordLastSet) { continue }

    # Check for a Fine-Grained Password Policy on this user
    $fgpp = Get-ADUserResultantPasswordPolicy -Identity $user -ErrorAction SilentlyContinue
    $effectiveMaxAge = if ($fgpp) { $fgpp.MaxPasswordAge.Days } else { $maxPasswordAge }

    if ($effectiveMaxAge -eq 0) { continue }

    $expiryDate = $user.PasswordLastSet.AddDays($effectiveMaxAge)
    $daysRemaining = (New-TimeSpan -Start (Get-Date) -End $expiryDate).Days

    # Only care about users expiring within the largest notify window
    if ($daysRemaining -lt 0 -or $daysRemaining -gt ($notifyDays | Measure-Object -Maximum).Maximum) {
        continue
    }

    $shouldNotify = $notifyDays -contains $daysRemaining
    $emailSent = "NO"

    if ($shouldNotify) {
        if ([string]::IsNullOrWhiteSpace($user.EmailAddress)) {
            $skippedNoEmail += $user.SamAccountName
            $emailSent = "NO EMAIL ON FILE"
        }
        elseif ($testMode) {
            $emailSent = "TEST MODE — NOT SENT"
        }
        else {
            $dayWord = if ($daysRemaining -eq 1) { "day" } else { "days" }

            $userBody = @"
Hello $($user.DisplayName),

Your $companyName network password will expire in $daysRemaining $dayWord on $($expiryDate.ToString("dddd, MMMM d")).

TO CHANGE IT NOW:

If you are in the office or connected to VPN:
  1. Press Ctrl + Alt + Delete
  2. Click "Change a password"
  3. Enter your current password, then your new one twice

If you cannot connect to the network:
  Contact the service desk before your password expires.

WHAT HAPPENS IF YOU DO NOTHING:
You will be locked out of email, VPN, and all network resources until the
service desk resets your password for you.

This is an automated message. Please do not reply.

$companyName IT
"@

            try {
                Send-MailMessage `
                    -From $from -To $user.EmailAddress `
                    -Subject "Action required: your password expires in $daysRemaining $dayWord" `
                    -Body $userBody `
                    -SmtpServer $smtpServer -Port $smtpPort `
                    -UseSsl -Credential $credential

                $emailSent = "SENT"
                $notifiedCount++

            } catch {
                $emailSent = "FAILED: $_"
            }
        }
    }

    $report += [PSCustomObject]@{
        DisplayName    = $user.DisplayName
        SamAccountName = $user.SamAccountName
        EmailAddress   = $user.EmailAddress
        ExpiryDate     = $expiryDate.ToString("yyyy-MM-dd")
        DaysRemaining  = $daysRemaining
        Notified       = $emailSent
    }

    Add-Content -Path $logFile -Value "$timestamp — $($user.SamAccountName) — expires $($expiryDate.ToString('yyyy-MM-dd')) — $daysRemaining days — $emailSent"
}

# Export report
$report | Sort-Object DaysRemaining | Export-Csv -Path $reportFile -NoTypeInformation

# Build admin summary
$adminBody = "Password Expiry Report — $timestamp`n"
$adminBody += "Domain max password age: $maxPasswordAge days`n"
$adminBody += "Test mode: $testMode`n"
$adminBody += "Users expiring within $(($notifyDays | Measure-Object -Maximum).Maximum) days: $($report.Count)`n"
$adminBody += "Notification emails sent: $notifiedCount`n`n"

if ($report.Count -gt 0) {
    $adminBody += "UPCOMING EXPIRIES:`n"
    $adminBody += "=" * 60 + "`n"
    foreach ($entry in ($report | Sort-Object DaysRemaining)) {
        $adminBody += "$($entry.DaysRemaining) day(s) — $($entry.DisplayName) ($($entry.SamAccountName)) — $($entry.Notified)`n"
    }
}

if ($skippedNoEmail.Count -gt 0) {
    $adminBody += "`nNO EMAIL ADDRESS ON FILE — CANNOT NOTIFY:`n"
    $adminBody += "=" * 60 + "`n"
    $skippedNoEmail | ForEach-Object { $adminBody += "  !! $_`n" }
}

$adminBody += "`nFull report saved to: $reportFile`n"
$adminBody += "`nAutomate & Operate — automateandoperate.com"

Send-MailMessage `
    -From $from -To $adminTo `
    -Subject "Password Expiry Report — $($report.Count) upcoming, $notifiedCount notified" `
    -Body $adminBody `
    -SmtpServer $smtpServer -Port $smtpPort `
    -UseSsl -Credential $credential

-ExecutionPolicy Bypass -File "C:\Scripts\PasswordExpiryNotify.ps1"

powershell.exe -ExecutionPolicy Bypass -File "C:\Scripts\PasswordExpiryNotify.ps1"