Password Generation Script (Latest) (296930)

The Active Roles Password Generation Script receives periodic updates based on encountered issues and varying product usage scenarios. These defects are tracked under Defect ID 101676.

In this KB you will find an attached, an up-to-date version of the Password Generation Script. As the script is updated with features or defects are resolved, it will be updated here for quick delivery. As new versions of Active Roles are released, they will include the latest version of the script that is available at that time.

FEATURES

• Uses most restrictive minimum password length (policy parameter, domain password policy, fine-grained password policy).
• Check to make sure object names are not included in the generated password (first name, last name, samaccountname).
• Parameters to configure password generation options:
  • Password Length
  • Character Input Strings
  • Special Characters
  • Use Special Characters (true/false)
  • Disable Manual Edit (true/false)
• Parameters allow different password generation options to be set and scoped to multiple containers by creating separate policy objects.

NOTE

It was discovered that the password auto-generation feature was not working as expected. It has been removed from the password generation script for the time being until a proper resolution can be found.

1. Download the attached file, Generate User Password.ps1
2. Open the downloaded file in a text editor of your choice
3. Copy the script in its entirety to the clipboard
4. As an Active Roles administrator, in the Active Roles Console (MMC), navigate to the following:
   Configuration | Script Modules | Builtin
5. Copy the original script module labeled Generate User Password - PowerShell
6. Edit the copied script module
7. Replace the entire contents of the script module with the contents copied in step 3 above
8. Save the script module changes
9. Remove the script module from the policy
10. Re-add the script module back into the policy

Note: It is recommended to create a new custom policy, and add the script module to be able to configure the parameters for password generation.

CHANGE LOG

• Fixed issue with comments causing problems with parameters.

• Fixed instances where the generated password did not contain a number.
• Simplified the random password generation function.
• Fixed bug where special characters were being used even when the parameter was set to False.

• Added parameter to disable manual edit of password field.

• Added proper default values for parameters to be filled in automatically.
• Made parameters required to avoid empty parameters.
• Modified data type of some parameters.
• Fixed quotes throughout script
• Added case for copy user to check containing name attribute values.
• Added parameter for "Auto-Generate Password" which allows the password to be automatically generated without the click of a button. This can be used with the Synchronization Service or to save time if passwords are often automatically generated.