ActiveDirectory/Get-FakePWChanges.ps1 at main · PyroTek3/ActiveDirectory · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
# PowerShell script authored by Sean Metcalf (@PyroTek3)
# 2026-02-26
# Last Updated: 2026-03-06
# Script provided as-is

Param
 (
    [string]$Domain = $env:userdnsdomain,
    [switch]$CheckADAdmins,
    [switch]$AllUsers
 )

IF ( ($CheckADAdmins -eq $False) -AND ($AllUsers -eq $False) )
 { [switch]$CheckADAdmins = $True }

[string]$DomainDC = (Get-ADDomainController -Discover -DomainName $Domain).Name
[array]$DomainInfo = Get-ADDomain -Server $DomainDC

IF ($CheckADAdmins -eq $True)
 {
    Write-Host "Discovering AD Admins..." -ForegroundColor Cyan
    [array]$ADAccountArray = Get-ADGroupMember -Identity 'Administrators' -Recursive -Server $DomainDC
 }

IF ($AllUsers -eq $True)
 {
    Write-Host "Discovering All User Accounts..." -ForegroundColor Cyan
    [array]$ADAccountArray = Get-ADUser -Filter * -Server $DomainDC
 }

Write-Host "Identifying Fake Password Changes for Accounts..." -ForegroundColor Cyan
$ADAccountMetaDataArray = @()
ForEach ($ADAccountArrayItem in $ADAccountArray)
 {
    $ADAccountMetaDataValueArray = Get-ADReplicationAttributeMetadata -Server $DomainDC -Object $ADAccountArrayItem.DistinguishedName -prop unicodepwd,pwdlastset
    $ADAccountMetaDataValueArrayPwdLastSet = $ADAccountMetaDataValueArray | Where {$_.AttributeName -eq 'pwdLastSet'}
    $ADAccountMetaDataValueArrayunicodePwd = $ADAccountMetaDataValueArray | Where {$_.AttributeName -eq 'unicodePwd'}

    $ADAccountMetaDataValueArrayPwdLastSetDate = ($ADAccountMetaDataValueArrayPwdLastSet.LastOriginatingChangeTime).ToString('yyyy-MM-dd')
    $ADAccountMetaDataValueArrayunicodePwdPwdDate = ($ADAccountMetaDataValueArrayunicodePwd.LastOriginatingChangeTime).ToString('yyyy-MM-dd')


    IF ($ADAccountMetaDataValueArrayPwdLastSetDate -eq $ADAccountMetaDataValueArrayunicodePwdPwdDate)
     { $DidPasswordChangeValue = $True }
    ELSE
     { $DidPasswordChangeValue = $False }

    $ADAccountMetaDataRecord = [PSCustomObject]@{
        AccountID              = $ADAccountArrayItem.SAMAccountName
        AccountDN              = $ADAccountArrayItem.DistinguishedName
        PasswordLastSet        = $ADAccountMetaDataValueArrayPwdLastSet.LastOriginatingChangeTime
        PasswordLastChanged    = $ADAccountMetaDataValueArrayunicodePwd.LastOriginatingChangeTime
        PasswordChanged        = $DidPasswordChangeValue
      }
    [array]$ADAccountMetaDataArray += $ADAccountMetaDataRecord
 }

IF ($CheckADAdmins -eq $True)
 {
    Write-Host "$Domain AD Admin Account Password Changes:" -ForegroundColor Cyan
    $ADAccountMetaDataArray | Sort AccountID | Format-Table -AutoSize
 }

IF ($AllUsers -eq $True)
 {
    Write-Host "$Domain Domain Accounts with Fake Password Changes:" -ForegroundColor Cyan
    $ADAccountMetaDataArray | Where-Object {$_.PasswordChanged -eq $False} | Sort AccountID | Format-Table -AutoSize
 }