Can't pull Max Password Age with vbscrip

ok, here's setup.  company has been building new 2012 domain environment.  far, servers in domain 2012.

with new domain, have begun testing fine-grained password policies because 1 of functions not on our old domain.  , far, on domain side appear working fine.

so comes problem.  because our users using remote-apps connect servers, aren't going notified passwords expiring soon.  enters vbscript.

using microsofts instructions, http://msdn.microsoft.com/en-us/library/ms974598.aspx, have been trying script going pop message telling user need change password, i've hit brick wall part of script.

set objdomain = getobject("ldap://" & objadsysteminfo.domaindnsname) set objmaxpwdage = objdomain.get("maxpwdage")      if objmaxpwdage.lowpart = 0         wscript.echo "the maximum password age set 0 in " & _                      "domain. therefore, password not expire."         wscript.quit

for reason, not pull max password age.  i'm using fine-grained passwords test account, have tried setting max password age in default domain policy, , still message "age set 0 , password not expire" though know policy functioning on account.

i thinking might need try , information attribute http://msdn.microsoft.com/en-us/library/cc220303.aspx, unsure of how call information.

if can script pull max password age, believe can rest of script working.

when bind default naming context , read maxpwdage reading default domain account policy that's written there pdce dc. series of articles job of explaining relationship: http://jorgequestforknowledge.wordpress.com/2010/09/27/password-policies-and-account-lockout-policies-within-an-ad-domain-part-1/

i haven't used fine-grained password policies in past unfortunately can't test looks of following article need bind user account in question , attempt retrieve msds-resultantpso constructed attribute: http://technet.microsoft.com/en-us/library/cc770848(v=ws.10).aspx if that's null need maths passwordlastchanged against maxpwdage. if it's not null need script bit more processing find relevant pso in password settings container , read equivalent of maxpwdage out of pso. looks of article, msds-maximumpasswordage  attribute:
http://technet.microsoft.com/en-us/library/cc754461(v=ws.10).aspx
i hope helps,
mark

 

Windows Server  >  Directory Services