title: Gracefully extend AD attribute pwdLastSet via PowerShell
body: <p>Over a period of 35 days, we will be forcing users to reset their passwords at next login. </p>
  
  <p>I've tested setting a users pwdLastSet attribute to 0 then -1, effectively resetting it to that point in time, so they'd be required to reset their password 90 days out (our current policy for password age is 90 days). </p>
  
  <p>What I'm trying to figure out is how to gracefully change the pwdLastSet date for my users so that I "decompress" their password age from 35 days back to 90 days (we get a lot of password related calls every day, doing nothing would only make things worse).</p>
  
  <p>I am capturing the users with these commands:</p>
  
  <pre><code>$dateam = (Get-Date $date -hour 0 -Minute 00 -Second 00).ToFileTime()
  $datepm = (Get-Date $date -Hour 23 -Minute 59 -Second 59).ToFileTime()
  $users = (Get-ADUser -Filter {(pwdLastSet -gt $dateam) -and (pwdLastSet -lt $datepm) -and (extensionAttribute2 -notlike "*")} -Properties pwdLastSet, extensionAttribute2 -SearchBase "OU=users,DC=domain,DC=com").SamAccountName
  </code></pre>
  
  <p>Because I can only set the pwdLastSet attribute date to the current day/time, I believe I need to run something daily to capture users, save the usernames to a file to be picked up in the future (and then setting extensionAttribute2 to any value so they don't get picked up again in a future run)</p>
  
  <p>Where I'm struggling is the logic in keeping things to 90 days. If possible, I want to prevent a user from having their pwdLastSet attribute set, say 35 days after their forced password change, so in effect their next password change is 105 days out. </p>
  
  <p>I have all sorts of test code, but nothing terribly useful. Please help!</p>