Changing user properties in powershell

Question

I have a script that creates a user and assigns a password and a user to a group, but I need to set two checkboxes - “User cannot change password” and “Password never expires”, but I can’t figure out how to do it for the service life.

My script so far:

# Create User and add to IGNITEWEBUSERS Group $user = $domain # If more then 15 chars trim to just 15 chars $user = $user.substring(0, 15) $user = $user + "_web" # Generate Random Complex Password # Generate a password with 2 non-alphanumeric character. $Length = 10 $Assembly = Add-Type -AssemblyName System.Web $RandomComplexPassword = [System.Web.Security.Membership]::GeneratePassword($Length,2) $password = $RandomComplexPassword $group = 'IGNITEWEBUSERS' $objOu = [ADSI]"WinNT://$computer" $objUser = $objOU.Create("User", $user) $objUser.setpassword($password) $objUser.SetInfo() $objUser.description = $domain + " IIS User" $objUser.SetInfo() $OBjOU = [ADSI]"WinNT://$computer/$group,group" $OBjOU.Add("WinNT://$computer/$user") 

This works and does what it should do, but does anyone know how I can set these 2 checkboxes? Various themes offer something similar to Set-ADUser -CannotChangePassword:$true , but I do not use Active Directory, and this does not work.

Your advice is welcome.

Floor

Answer 1

Got it this morning: -

 $objUser.UserFlags = 64 + 65536 # ADS_UF_PASSWD_CANT_CHANGE + ADS_UF_DONT_EXPIRE_PASSWD 

Answer 2

Set the useraccountcontrol property. Here you can find a list of useraccountcontrol flags: http://support.microsoft.com/kb/305144

Add the values ​​of the necessary flags (NORMAL_ACCOUNT = 512, PASSWD_CANT_CHANGE = 64, DONT_EXPIRE_PASSWORD = 65536) for a total of 66112 and set the following value for this property:

 $obUser.useraccountcontrol = 66112 

By the way, you only need to call the SetInfo () method once at the end after setting all the properties you want to set.

Answer 3

Use WMI to get a user account:

 # Use this filter so WMI doesn't spend forever talking to domain controllers. $user = Get-WmiObject Win32_UserAccount -Filter ("Domain='{0}' and Name='{1}'" -f $env:ComputerName,$Username) $user.PasswordChangeable = $false $user.PasswordExpires = $false $user.Put()