Accesing ADUser.extensionAttribute from ps1 script
I'm trying to modify ps1 script which I found in the web. It should check how many days left before password expiration and send notification e-mail to address, stored in Active Directory account attribute - extensionAttribute1. There is no way to use native email attribute because some accounts has no emails (system accounts which unable to use MSA) and usualy I have to notify user and send copy to myself to keep this in mind. The reason: some users cannot be notifyed by the Windows system message at logon because they working in domain network through VPN (win XP). There is a code:
Import-Module ActiveDirectory
#System globalization
$ci = New-Object System.Globalization.CultureInfo("en-US")
#SMTP server name
$smtpServer = "mail.domain.local"
#Creating a Mail object
$msg = new-object Net.Mail.MailMessage
#Creating SMTP server object
$smtp = new-object Net.Mail.SmtpClient($smtpServer)
#E-mail structure
Function EmailStructure($to,$expiryDate,$upn)
{
$msg.IsBodyHtml = $true
$msg.From = "[email protected]"
$msg.To.Add($to)
$msg.Subject = "Password expiration notice"
$msg.Body = "<html><body><font face='Arial'>This is an automatically generated message from Exchange service.<br><br><b>Please note that the password for your account $upn will expire on $expiryDate.</b><br><br>Please change your password immediately or at least before this date as you will be unable to access the service without contacting your administrator.</font></body></html>"
}
#Set the target OU that will be searched for user accounts
$OU = "OU=Domain,DC=domain,DC=local"
$ADAccounts = Get-ADUser -LDAPFilter "(objectClass=user)" -searchbase $OU -properties PasswordExpired, PasswordNeverExpires, PasswordLastSet, Mail, Enabled | Where-object {$_.Enabled -eq $true -and $_.PasswordNeverExpires -eq $false}
Foreach ($ADAccount in $ADAccounts)
{
$accountFGPP = Get-ADUserResultantPasswordPolicy $ADAccount
if ($accountFGPP -ne $null) {
$maxPasswordAgeTimeSpan = $accountFGPP.MaxPasswordAge
} else {
$maxPasswordAgeTimeSpan = (Get-ADDefaultDomainPasswordPolicy).MaxPasswordAge
}
#Fill in the user variables
$samAccountName = $ADAccount.samAccountName
<-- $userEmailAddress = $ADAccount.extensionAttribute1 -->
$userPrincipalName = $ADAccount.UserPrincipalName
if ($ADAccount.PasswordExpired) {
Write-host "The password for account $samAccountName has expired!"
} else {
$ExpiryDate = $ADAccount.PasswordLastSet + $maxPasswordAgeTimeSpan
Write-host "The password for account $samAccountName expires on: $ExpiryDate"
$TodaysDate = Get-Date
$DaysToExpire = $ExpiryDate - $TodaysDate
#Write-Host $DaysToExpire.Days
if ($DaysToExpire.Days -lt 7) {
$expiryDate = $expiryDate.ToString("d",$ci)
#Generate e-mail structure and send message
if ($userEmailAddress) {
EmailStructure $userEmailAddress $expiryDate $userPrincipalName
$smtp.Send($msg)
}
Write-Host "NOTIFICATION - $samAccountName :: e-mail was sent to $userEmailAddress"
}
}
}
But command line doesn't returning "extensionAttribute1". I've marked it by arrows. Could somebody help with it?
Answer
You need to include extensionAttribute1 it in -Properties parameter ($ADAccounts assignment).
$ADAccounts = Get-ADUser ... -Properties extensionAttribute1,PasswordExpired...