Test-PasswordQuality only tells you which accounts are weak; the live
password filter only screens passwords at change time and never rescans
what is already set. This adds the detective half: for the accounts whose
password is in the KHDB, split them by pwdLastSet into a current filter
gap (set within RecentPasswordWindowDays, default 180) versus legacy
backlog (older), flag privileged (adminCount) hits, and diff against the
previous run for new/remediated/repeat offenders.
Each run now also writes a self-contained HTML report (filter-gap
headline, stat cards, trend, age-split tables, remaining DSInternals
hygiene findings) alongside the existing text and JSON, and, when any
enabled account is weak, a ForceReset work list plus a reviewed (never
auto-run) script that flags each to change password at next logon.
New setting RecentPasswordWindowDays documented in the sample and README;
README report section rewritten to explain the gap-vs-backlog model.
Tests: age-split/privileged/HTML, trend diff, force-reset enabled-only.
tomas.kracmar
908ec54bb9