7

We are using SharePoint 2010.

The website is an intranet portal with AD username authentication. When user opens the site in IE, the login window popsup. When user enters username and password and clicks 'OK', we need to alert the user if his/her password is about to expiry in 20 days or less. How can we catch the login popups 'OK' click event?

What is best practice for this? Please note that we do not want to purchase/reuse solutions from codeplex /others, instead we need to create this from scratch for various reasons.

Other options:-

If we create a webpart on the homepage that queries AD and gives an alert message then problem is that if user enters URL of any other page besiedes homepage, then he will not get this popup unless he clicks on homepage.

If we use masterpage then the alert box will come multiple times.. This can be controlled by using user profile property, but is there any other simple way?

4
+25

there is a little script on TechNet that solves this issue! no need for webparts.... webparts bring in other complications like when they are fine if you have a public open page that everyone first get to irregardless that contains the webpart on that page for login, when you login it will query ad if it needs change if it does than show the change part else login... but if your webpart is within a logged in area then how are they ment to change the password if its expired when the webpart is in a secured location you no longer have access to?

the script rather runs in the background similar to the timer job method:

This script will email a user in the event that their password is due to expire in X number of days.

Configure the SMTP Servername and the ExpireInDays variables at the start.

The script will query AD for the MaxPasswordAge value, and add that to a users last password set date, giving the expiry date.

If the date is less than your ExpireInDays variable an email will be sent.

You can configure the subject and the body of the message, and of course the send from address.

This is very useful when run as a scheduled task as it will reduce the number of support calls you might get due to expired passwords.

In the body of the message you can state how many days a user has until their password expires, and also give instructions on how to reset their password, or who they should talk to if they cannot do it.

http://gallery.technet.microsoft.com/Password-Expiry-Email-177c3e27


the script from the link above, you need to change only a few parts to suit your needs like days (instead of 21 change to 20), email adresss ect...

     #################################################################################################################
# 
# Version 1.1 May 2014
# Robert Pearman (WSSMB MVP)
# TitleRequired.com
# Script to Automated Email Reminders when Users Passwords due to Expire.
#
# Requires: Windows PowerShell Module for Active Directory
#
# For assistance and ideas, visit the TechNet Gallery Q&A Page.    http://gallery.technet.microsoft.com/Password-Expiry-Email-177c3e27/view/Discussions#content
#
  ##################################################################################################################
# Please Configure the following variables....
$smtpServer="mail.server.com"
$expireindays = 21
$from = "Company Administrator <support@mycompany.com>"
$logging = "Enabled" # Set to Disabled to Disable Logging
$logFile = "<log file path>" # ie. c:\mylog.csv
$testing = "Enabled" # Set to Disabled to Email Users
$testRecipient = "testuser@company.com"
$date = Get-Date -format ddMMyyyy
#
 ###################################################################################################################

# Check Logging Settings
if (($logging) -eq "Enabled")
{
   # Test Log File Path
   $logfilePath = (Test-Path $logFile)
   if (($logFilePath) -ne "True")
   {
       # Create CSV File and Headers
       New-Item $logfile -ItemType File
       Add-Content $logfile "Date,Name,EmailAddress,DaystoExpire,ExpiresOn"
   }
} # End Logging Check

# Get Users From AD who are Enabled, Passwords Expire and are Not Currently Expired
Import-Module ActiveDirectory
$users = get-aduser -filter * -properties Name, PasswordNeverExpires, 
PasswordExpired,    PasswordLastSet, EmailAddress |where {$_.Enabled -eq "True"} | where { $_.PasswordNeverExpires -eq $false } | where { $_.passwordexpired -eq $false }
$maxPasswordAge = (Get-ADDefaultDomainPasswordPolicy).MaxPasswordAge

# Process Each User for Password Expiry
foreach ($user in $users)
{
   $Name = (Get-ADUser $user | foreach { $_.Name})
   $emailaddress = $user.emailaddress
   $passwordSetDate = (get-aduser $user -properties * | foreach { $_.PasswordLastSet })
   $PasswordPol = (Get-AduserResultantPasswordPolicy $user)
   # Check for Fine Grained Password
   if (($PasswordPol) -ne $null)
   {
       $maxPasswordAge = ($PasswordPol).MaxPasswordAge
   }

   $expireson = $passwordsetdate + $maxPasswordAge
   $today = (get-date)
   $daystoexpire = (New-TimeSpan -Start $today -End $Expireson).Days

   # Set Greeting based on Number of Days to Expiry.

   # Check Number of Days to Expiry
   $messageDays = $daystoexpire

   if (($messageDays) -ge "1")
   {
       $messageDays = "in " + "$daystoexpire" + " days."
   }
   else
   {
       $messageDays = "today."
   }

   # Email Subject Set Here
   $subject="Your password will expire $messageDays"

   # Email Body Set Here, Note You can use HTML, including Images.
   $body ="
   Dear $name,
   <p> Your Password will expire $messageDays.<br>
   To change your password on a PC press CTRL ALT Delete and chose Change Password <br>
   <p>Thanks, <br> 
   </P>"


   # If Testing Is Enabled - Email Administrator
   if (($testing) -eq "Enabled")
   {
       $emailaddress = $testRecipient
   } # End Testing

   # If a user has no email address listed
   if (($emailaddress) -eq $null)
   {
       $emailaddress = $testRecipient    
   }# End No Valid Email

   # Send Email Message
   if (($daystoexpire -ge "0") -and ($daystoexpire -lt $expireindays))
   {
       # If Logging is Enabled Log Details
       if (($logging) -eq "Enabled")
       {
           Add-Content $logfile "$date,$Name,$emailaddress,$daystoExpire,$expireson" 
       }
       # Send Email Message
       Send-Mailmessage -smtpServer $smtpServer -from $from -to $emailaddress -subject $subject -body $body -bodyasHTML -priority High  

   } # End Send Message

  } # End User Processing



  # End
3

There is no capture for the "click" event of the ok button for an authentication prompt. This is normal authentication challenge (user is not authenticated and server will send a 401 request to start the auth process). In a "typical" environemnt the user will have single sign on using integrated auth and the user should no see a "popup" dialog. Not sure if the user is not in the domain or you are using a browser that does not support integrated auth.

General authflow (non claims):

http://www.microsoft.com/office/preview?videoid=9627c892-e5c8-410c-8f26-4964a5292801&from=sharepermalink-link

Source: http://technet.microsoft.com/en-us/library/jj219571(v=office.15).aspx

To solve your requirements I would suggest the following:

  • Create a custom http module
  • register for authentication requests (or specific urls like homepage.aspx or *.aspx)
    • you need to check if the page is able to display a UI (ignore word, excel, ...)
  • check if your did get a info for this day (database, ups, web server cache, ...)
  • add some javascript to notify the user about the needed action
  • if the use is the first time here it would look like he got the message right after the login prompt ok click

Even better but not as flexible and maybe not catching any page is the use of a delegate control. "Same code" as in http module, but you activate the new feature per site collection and if the masterpage is using the delegate control your could would be injected.

In both solution: You need to cache! Otherwithe the overall performance of you SharePoint will become really bad.

Try the delegate approach first. This should suite 80% of your requirments at least.

2

If you are open to using an already existing webpart, I suggest:

ITaCS Change Password web part

It lets users change their password and as far as I can remember, it also shows when the password is set to expire.

I use this webpart myself and am satisfied about it. The source code is available for viewing. It might inspire you for your own programming need.

1

In my point of view, One should create a customer timer job which runs daily.

Timer job check the all user accounts in the AD and if the passowrd is about to expire then send the alerts/ email to the user.

One thing, how many user you think you are dealing with this, if too many user. I would recommend to schedule this timer job off peak hours to less performance load on the SharePoint.

Here is guide how to create a custom timer job: http://dotnetfinder.wordpress.com/2010/07/24/creatingcustomsharepointtimerjob2010/

  • When user enters username and password and clicks 'OK', we need to query the AD and alert user if his password is going to expire in 20days or less.. Is this not possible? – variable Jul 24 '14 at 4:40
  • I think you can write code this but again this required alot of effort not an easy solution. – Waqas Sarwar MVP Jul 24 '14 at 4:50
  • How can we catch the OK button click event of AD login popup? – variable Jul 24 '14 at 4:51
  • I am not developer but i worked a team of developers to identify the issues. check this post give you the pointer...social.technet.microsoft.com/Forums/sharepoint/en-US/… – Waqas Sarwar MVP Jul 24 '14 at 4:54
  • Waqas, I have got the code to query the AD, but I am not aware how to catch the OK button click event of AD login popup? :) – variable Jul 24 '14 at 4:55
1

best practice - You can write a http module . After the user enters his/her credentials and clicks ok -> the http module would be able to capture the event . Write the code to query the AD and send email accordingly .

0

I think it is not a good idea to check password expiration on user log on. What if the user will not log to the system before the password expires?

Use script, timer job, scheduled task, anything. Basically, this does not have to be SP related question.

Just query AD once a day and send emails. You can also store the user names you have already notified and notify them later, 3-5 days before expiry date.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.