Add User Active Directory with password and compare with AD Password Complexity - powershell

Question

I'm trying to use a script to create User account on my AD.(Newbie)
I use this kind of powershell code:
Import-Module ActiveDirectory
#Intro
$date = Get-Date -Format "dd-MM-yyyy"
Echo "The $date - Adding new user"
#GET NAME and SURNAME :
$name = Read-Host "Enter the NAME of the user, please ?"
$surname = Read-Host "Enter the SURNAME of the user, please?"
#Username
$login = ($surname).Substring(0, 1).ToLower() + $name.Substring(0, 2).ToLower()
#Password requirement
Write-Verbose -Message "The password must contains : 8 char. with 1 maj. , 1 min. et 1 number or 1 char special." -Verbose
$password = Read-Host "Enter the password"
#Verify login does not exist
Echo "Wait a seconds..."
if (Get-ADUser -Filter { SamAccountName -eq $login }) {
Write-Warning "User Already Exist! please Try again..."
.\new_user.ps1
}
else {
#User Creation With File Folder
try {
New-ADUser -Name "$name $surname" -GivenName $name -Surname $surname -SamAccountName $login -UserPrincipalName $login#contonso.com -AccountPassword (ConvertTo-SecureString -AsPlainText $password -Force) -PasswordNeverExpires $true -CannotChangePassword $True -Enabled $true -path “OU=User, DC=Contonso, DC=com”
Write-Verbose -Message "The user account $login has been created and is active. Send an email with these credential" -Verbose
}
catch {
$_ | Out-File -FilePath C:\LOGS\EU-$login-$date.txt
Write-Warning "Sorry. An error as occured creating the user account. Thanks to try again."
}
try {
New-Item -Path \\FILESERVER\D$\Share\4.Users -Name "$login" -ItemType Directory
Write-Verbose -Message "The file folder of $login is now available." -Verbose
}
catch {
$_ | Out-File -FilePath C:\LOGS\ER-$login-$date.txt
Write-Warning "Sorry. An error as occurred while creating the folder, please contact the IT Team.Thanks"
}
}
If i put example "apple" as a password, the code will continue creating the account with the password but the account is disable and on my log i will have "Password does not fit with Active Directory complexity (set on GPO).
So i know there is a cmd: "Get-ADDefaultDomainPasswordPolicy" how to use it to compare my password with this ?
I found some function on internet but they use password policy directly on the powershell script.
In my case i want to compare directly with the ADDefaultDomainPassword Policy.
Any Idea? Thanks a lot

Answer 1

To test if a password would pass the complexity rules, you can use below function:
function Test-DomainPassword {
# see: https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements
[CmdletBinding()]
Param (
[Parameter(Mandatory = $true, ValueFromPipeline = $true, Position = 0)]
[ValidateNotNullOrEmpty()]
[string]$Password,
[string]$SamAccountName = $null,
[string]$DisplayName = $null
)
$PasswordPolicy = Get-ADDefaultDomainPasswordPolicy -ErrorAction SilentlyContinue
if ($Password.Length -lt $PasswordPolicy.MinPasswordLength) {
Write-Verbose "Password '$Password' is too short. Minimal length is $($PasswordPolicy.MinPasswordLength)"
return $false
}
if (($SamAccountName) -and ($Password -match [regex]::Escape($SamAccountName))) {
Write-Verbose "The password '$Password' includes the users SamAccountName"
return $false
}
if ($DisplayName) {
# The displayName is parsed for delimiters: commas, periods, dashes or hyphens, underscores, spaces, pound signs, and tabs.
# If any of these delimiters are found, the displayName is split and all parsed sections (tokens) are confirmed not to be
# included in the password.
# Tokens that are shorter than three characters are ignored, and substrings of the tokens aren't checked.
$tokens = $DisplayName -split '[-,._ #\t]'
foreach ($token in $tokens) {
if (($token) -and ($token.Length -ge 3) -and ($Password -match [regex]::Escape($token))) {
Write-Verbose "The password '$Password' includes (part of) the users DisplayName"
return $false
}
}
}
if ($PasswordPolicy.ComplexityEnabled) {
# see: https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/bb726984(v=technet.10)?redirectedfrom=MSDN
# chapter 'Passwords Must Meet Complexity Requirements':
# Passwords must use three of the four available character types:
# lowercase letters, uppercase letters, numbers, and symbols.
$failures = #()
# check for presence of
# - Uppercase: A through Z, with diacritic marks, Greek and Cyrillic characters
if ($Password -cnotmatch "[A-Z\p{Lu}\s]") {
$failures += "- The password is missing Uppercase characters"
}
# - Lowercase: a through z, sharp-s, with diacritic marks, Greek and Cyrillic characters
if ($Password -cnotmatch "[a-z\p{Ll}\s]") {
$failures += "- The password is missing Lowercase characters"
}
# - Base 10 digits (0 through 9)
if ($Password -notmatch "[\d]") {
$failures += "- The password is missing digits (0-9)"
}
# - Nonalphanumeric characters: ~!##$%^&*_-+=`|\(){}[]:;"'<>,.?/
if ($Password -notmatch "[^\w]") {
$failures += "- The password is missing Nonalphanumeric characters: ~!##$%^&*_-+=`|\(){}[]:;`"'<>,.?/"
}
# test if we have more than 1 mismatch (password needs at least 3 out of 4 to be OK)
if ($failures.Count -gt 1) {
Write-Verbose "The password '$Password' failed because:`r`n{0}" -f ($failures -join "`r`n")
return $false
}
}
$true
}
Use it like this:
# both parameters -SamAccountName and -DisplayName are optional
$displayName = '{0} {1}' -f $firstname, $surname
if (Test-DomainPassword -Password $password -SamAccountName $login -DisplayName $displayName -Verbose) {
# the password is OK, create the new user here:
$userParams = #{
SamAccountName = $login
GivenName = $firstname
Surname = $surname
DisplayName = $displayName
UserPrincipalName = '{0}#contonso.com'-f $login
AccountPassword = ConvertTo-SecureString -String $password -AsPlainText -force
PasswordNeverExpires = $true
CannotChangePassword = $true
Path = 'OU=User,DC=Contonso,DC=com'
Enabled = $true
# etcetera
}
New-ADUser #userParams
}
else {
Write-Warning "User $login NOT created because the password did not pass the test"
}