# encoding: ascii
# api: powershell
# title: Get-DomainPasswordPolicy
# description: This is a function that queries the domain for the password policies that are set via Group Policy. Output objects include Min Password Length, Min Password Age, Max Password Age, number of passwords remembered (for password history restrictions), Lockout Threshold, Lockout Duration, and the Lockout Counter Reset time.
# version: 0.1
# type: function
# author: AlphaSun
# license: CC0
# function: Get-DomainPasswordPolicy
# x-poshcode-id: 2939
# x-archived: 2017-03-18T15:27:41
# x-published: 2012-08-31T14:43:00
#
#
function Get-DomainPasswordPolicy
{
$domain = [ADSI]"WinNT://$env:userdomain"
$Name = @{Name="DomainName";Expression={$_.Name}}
$MinPassLen = @{Name="Minimum Password Length (Chars)";Expression={$_.MinPasswordLength}}
$MinPassAge = @{Name="Minimum Password Age (Days)";Expression={$_.MinPasswordAge.value/86400}}
$MaxPassAge = @{Name="Maximum Password Age (Days)";Expression={$_.MaxPasswordAge.value/86400}}
$PassHistory = @{Name="Enforce Password History (Passwords remembered)";Expression={$_.PasswordHistoryLength}}
$AcctLockoutThreshold = @{Name="Account Lockout Threshold (Invalid logon attempts)";Expression={$_.MaxBadPasswordsAllowed}}
$AcctLockoutDuration = @{Name="Account Lockout Duration (Minutes)";Expression={if ($_.AutoUnlockInterval.value -eq -1) {'Account is locked out until administrator unlocks it.'} else {$_.AutoUnlockInterval.value/60}}}
$ResetAcctLockoutCounter = @{Name="Reset Account Lockout Counter After (Minutes)";Expression={$_.LockoutObservationInterval.value/60}}
$domain | Select-Object $Name,$MinPassLen,$MinPassAge,$MaxPassAge,$PassHistory,$AcctLockoutThreshold,$AcctLockoutDuration,$ResetAcctLockoutCounter
}