One little drawback of BPOS is the fact that User Passwords do have an expiration policy. Don’t get me wrong, from a security perspective this is a good thing. Only it could be that some users do not have a real life user associated with them. For example the user in my previous post. When the password of this user expires the mail functionality will fail.
I had to think of something that would reset the password automatically.
First thought that came to my mind is PowerShell (also a good thing). Second was the Migration Tools command Set-MSOnlineUserPassword
btw: You can download the migration tools here: (x86) 32 bit version, (x64) 64 bit version
I also wanted this to secure my admin credentials
I am going to store the admin password encrypted in a file. To do this first of all get your credentials by issuing the command:
$credential = get-credential
This will give you a popup box in which you have to enter your MS online credentials. Now to store the password encrypted in a file, issue the command:
$credential.Password | ConvertFrom-SecureString | Set-Content <filename>
Look at the content of <filename>, you specified. It is encrypted.
Now how can you use this password to automatically log into you Microsoft Online environment.
$user = "admin@<yourbposdomain>"$password = Get-Content $File `
| ConvertTo-SecureString $credential = `
New-Object System.Management.Automation.PsCredential($user,$password)
Note: The back-tick (`) symbol is the PowerShell line-continuation character that allows you to continue a command on multiple lines
To store the passwords for the individual users you have is (to my knowledge) still not possible without providing some kind of encryption key (it than can be decrypted with the help of the content of the script you are making here, so extra work for nothing). If you would use the above method you would eventually get a password that is in plain text “System.Security.SecureString”.
If someone has a way to do this, I would love to hear it in the comments.
Ok, the complete script:
Note: The migration tools use a Powershell snapin which you have to load into your powershell session: Add-PSSnapin microsoft.exchange.transporter
# Load Migration tools snapin
Add-PSSnapin microsoft.exchange.transporter
#variabelen voor BPOS Admin
$SecurePassAdmin = "c:\securepass.enc"
$AdminUser = "<admin>@<your microsoftonline domain.com>"
#Set Admin Credentials
$PasswordAdmin = Get-Content $SecurePassAdmin | ConvertTo-SecureString
$AdminCredentials = `
New-Object System.Management.Automation.PsCredential`
($AdminUser,$PasswordAdmin)
#change password users
set-msonlineuserpassword -identity <your user> -credential `
$AdminCredentials -Password "<user password>" `
-ChangePasswordOnNextLogon $false -verbose
Now schedule this to run every month or so, and you are done.
Some trouble I ran into:
- when scheduling the command I constantly received the error: object reference not set to an instance of an object. This bugged me some time. Powershell knew the command set-msonlinemailuserpassword but it still gave the erorr. I scheduled it under a new user I created and apparently you have to start Internet explorer first under the credentials of the user to make it work.
