Você pode executar um script todos os dias à meia-noite e, se a senha estiver definida para expirar durante o dia seguinte, você força a expiração.
Um pouco ilustrado lá
Nunca testei no VBS;
Const SEC_IN_DAY = 86400
Const ADS_UF_DONT_EXPIRE_PASSWD = &h10000
Const ADS_SCOPE_SUBTREE = 1000
dim strname
dim strdist
dim dtmvalue
on error resume next
Set objConnection = CreateObject("ADODB.Connection")
Set objCommand = CreateObject("ADODB.Command")
objConnection.Provider = "ADsDSOObject"
objConnection.Open "Active Directory Provider"
Set objCommand.ActiveConnection = objConnection
objCommand.Properties("Page Size") = 1000
objCommand.Properties("Searchscope") = ADS_SCOPE_SUBTREE
objCommand.CommandText = "SELECT distinguishedName, profilepath, name from 'LDAP://dc=Example,dc=com' where objectCategory = 'User'"
Set objuserRecordSet = objCommand.Execute
objUSerRecordSet.MoveFirst
Do Until objuserRecordSet.EOF
strdist = objuserRecordSet.Fields("distinguishedName").Value
strname = objuserRecordSet.Fields("name").Value
Set objUserLDAP = GetObject _
("LDAP://" & strdist)
intCurrentValue = objUserLDAP.Get("userAccountControl")
dtmValue = objUserLDAP.PasswordLastChanged
If intCurrentValue and ADS_UF_DONT_EXPIRE_PASSWD Then
x = "The password does not expire."
Else
Set objDomainNT = GetObject("WinNT://escc.gov.uk")
intMaxPwdAge = objDomainNT.Get("MaxPasswordAge")
If intMaxPwdAge < 0 Then
x = "Password does not expire"
Else
intMaxPwdAge=intMaxPwdAge/86400
strold = ((dtmValue + intMaxPwdAge)-now)
if strold < 2 and strold > 0 then
objUserLDAP.pwdLastSet = 0
objUserLDAP.SetInfo
end if
end if
End If
dtmValue= ""
objuserrecordset.movenext
Loop
Ou há para um powershell exemplo:
# This PowerShell Script will query Active Directory and return the user accounts with passwords
# set to expire before the end of the next day, export a list of the affected accounts, and require
# a password change at the next logon. The script is configured to ingore accounts which have been
# configured with passwords that never expire, and to ignore accounts who do not have permission to
# change their own password. Any other account would be affected, so be warned before running this
# script, as you could experience unintended consequences. Either modify the script to reduce the
# scope of user accounts, or ensure that accounts that shouldn't be affected are either flaged with
# a non-expiring password or are flagged with "cannot change password. When ready to run/schedule
# in production, remove the -WhatIf from the last line.
#
# - MWT, 10/11/13
# The 89 is based upon your environment. If passwords expire every X (90) days, and you run the script
# in the early morning, you can set it to -1*(X-1) (-89), if you run the script late at night, set it to
# -1*(X-2) (-88).
Import-Module ActiveDirectory # Required for PowerShell 2.0 only
$a = (Get-Date).Date.AddDays(-89)
# The following line will build the variable based upon the noted criteria
$b = Get-ADUser -Property Name,SamAccountName,PasswordLastSet,CannotChangePassword,PasswordNeverExpires -Filter {(PasswordLastSet -lt $a) -and (PasswordNeverExpires -eq $false)} | Where-Object {$_.CannotChangePassword -eq $false}
# The following line will display/export the data logging the accounts to be changed; please note the
# Out-File path and change to suit your needs.
$b | Format-Table Name,PasswordLastSet,CannotChangePassword,PasswordNeverExpires -AutoSize | Out-File -FilePath C:\passwordchanges.txt
# The following line will actually flag the accounts to require a password change (after -WhatIf is removed)
$b.SamAccountName | ForEach-Object {Set-ADUser -Identity $_ -ChangePasswordAtLogon $true -WhatIf}