【玩转域控安全】域密码治理-自动化域密码过期邮件通知（附脚本）

“域控和win10都创建好了，接下来可以测试脚本了。”

 

 

 

01

—

调试脚本

 

使用的是Send-Mailmessage命令发送邮件，参数都预先配置好

发件箱使用的是163邮箱，实际生产要使用公司管理员邮箱

testing 参数设置为true，代表只发送给给管理员

$SearchBase="DC=pentest,DC=COM"
$smtpServer="smtp.yeah.net"
$expireindays = 60 #number of days of soon-to-expire paswords. i.e. notify for expiring in X days (and every day until $negativedays)
$negativedays = -3 #negative number of days (days already-expired). i.e. notify for expired X days ago
$from = "manager_admin <manager_admin@yeah.net>"
$logging = $true # Set to $false to Disable Logging
$logNonExpiring = $false
$logFile = "C:\Users\Administrator\Desktop\PS-pwd-expiry.csv" # ie. c:\mylog.csv
$testing = $false # Set to $false to Email Users
$adminEmailAddr = "manager_admin@yeah.net","manager_admin@yeah.net","manager_admin@yeah.net" #multiple addr allowed but MUST be independent strings separated by comma
$sampleEmails = 1 #number of sample email to send to adminEmailAddr when testing ; in the form $sampleEmails="ALL" or $sampleEmails=[0..X] e.g. $sampleEmails=0 or $sampleEmails=3 or $sampleEmails="all" are all valid.
$password = convertto-securestring "发邮件的密码" -asplaintext -force
$cred=new-object -typename System.Management.Automation.PSCredential -argumentlist "manager_admin",$password

经过对脚本的调试和修改，使用powershell在域控运行

 

 邮件发送日志将记录为csv

 

 域用户user1收到邮件效果如下

 

 接下来在域控创建一个设置计划任务，让脚本每天都运行