Process Password Expiration

Question

I wish to know how can I search for users who have certain password expiration date.
For example, base on the date, I would like to send different emails to user. 1 months before expiration date, user receives a reminder email, 7 days before expiration date, user receives a warning email.
I don't want to scan one by one all the users, get user object, then get the expiration date and do the comparison. I think this is too slow for a big number of users.
Is there any faster way? for example by using attribute condition? How?
Thank you,
Steve

Answer 1

I've done this a couple times using the per-account reconciliation workflow. Its certainly not glamorous, but it does work.
The requirement was to notify AD users one moth and one week before password expiration. Reconciliation was run nightly against AD and I added a per-account workflow. The workflow checked the account expiration attribute and calculated how far it was away from today. If it was 30 or 7 days, I send an email reminder to the user.
The solution did not significantly impact performance. A couple things you'll need to keep in mind. One, add a bunch of conditions up front to keep the speed up. Two, the variable userName is available in the per-account workflow when the recon condition is MATCHED. Finally, you're bound to your reconciliation schedule, so you may have to do some conditionals to make sure you aren't reminding people every night or every week.