Password on Janik von Rotz

Migrate From Pass to KeepassXC

Mon, 13 Apr 2026 08:26:08 +0200

In 2017 I migrated from KeePass to Pass and now migrated back to KeePassXC. For almost 9 years I was a happy pass user. It still does a very good job and keeping password management simple. But setting up pass on a new device was always a bit difficult.

Whenever I wanted to access my passwords on a new deceive I had to:

Get ssh key to clone the pass repo
Import the pgp key to access the pass repo

Moreover, I missed two essential features:

Browser-Plugin
Passkey support

And KeePassXC supports both of these cases. In addition I already used KeePassXC:

To store and load my ssh key
As password management for my company

Export

There were over 400 entries in my pass store. A manual migration was out of question. I created script that parsed the pass entries and handled the following cases:

OTP entries
Fallback to default username
Escaping strings
Process additional fields

And here is the script / bash function:

export-keepass-csv() {
    if test -z "$1"; then
        echo "\$1 is empty." >&2
        return 1
    fi

    OUTPUT_FILE="$1"
    PASS_DIR="${PASSWORD_STORE_DIR:-$HOME/.password-store}"

    # Validate PASS_DIR exists
    if [[ ! -d "$PASS_DIR" ]]; then
        echo "Error: Password store directory not found: $PASS_DIR" >&2
        return 1
    fi

    # Header (already properly quoted)
    echo '"Group","Title","Username","Password","URL","Notes","TOTP"' > "$OUTPUT_FILE"

    # Use process substitution to avoid subshell
    while read -r FILE; do
        echo "Parse pass file: ${FILE#$PASS_DIR/}"

        REL_PATH="${FILE#$PASS_DIR/}"
        REL_PATH="${REL_PATH%.gpg}"
        GROUP="Root/Pass/$(dirname $REL_PATH)"
        FOLDER="$(dirname "$GROUP")"
        TITLE="$(basename "$REL_PATH")"
        ENTRY="$(pass show "$REL_PATH")"

        # Extract password (first line)
        PASSWORD="$(printf '%s' "$ENTRY" | head -n1)"

        # Initialize fields
        USERNAME=""
        URL="https://$TITLE"
        NOTES=""
        TOTP=""

        # Parse additional key-value lines (skip first line)
        while IFS= read -r LINE; do
            case "$LINE" in
                username:*) USERNAME="${LINE#username: }" ;;
                Username:*) USERNAME="${LINE#Username: }" ;;
                notes:*)     NOTES="${LINE#notes: }" ;;
                Notes:*)     NOTES="${LINE#Notes: }" ;;
                url:*)       URL="${LINE#url: }" ;;
                Url:*)       URL="${LINE#Url: }" ;;
                totp:*)      TOTP="${LINE#totp: }" ;;
            esac
        done <<< "$(printf '%s\n' "$ENTRY" | tail -n +2)"

        # If password starts with otpauth://, extract the secret and set as TOTP
        if [[ "$PASSWORD" == otpauth://* ]]; then
            # Extract secret from otpauth URL using query parameter parsing
            SECRET=$(echo "$PASSWORD" | sed -n 's/.*secret=\([^&]*\).*/\1/p' | tr '[:lower:]' '[:upper:]')
            if [[ -n "$SECRET" ]]; then
                TOTP="$SECRET"
            fi
        fi

        # Use fallback username based on folder
        if [[ "$USERNAME" == "" ]]; then
            if [[ "$FOLDER" == *"private"* ]]; then
                USERNAME="$FALLBACK_USERNAME_private"
            elif [[ "$FOLDER" == *"mint-system"* ]]; then
                USERNAME="$FALLBACK_USERNAME_mint_system"
            elif [[ "$FOLDER" == *"sozialinfo"* ]]; then
                USERNAME="$FALLBACK_USERNAME_sozialinfo"
            fi
        fi

        # Function to escape double quotes and wrap in quotes for CSV
        PASSWORD_CSV=$(printf '%s' "$PASSWORD" | sed 's/"/""/g; s/.*/"&"/')
        USERNAME_CSV=$(printf '%s' "$USERNAME" | sed 's/"/""/g; s/.*/"&"/')
        NOTES_CSV=$(printf '%s' "$NOTES" | sed 's/"/""/g; s/.*/"&"/')
        TOTP_CSV=$(printf '%s' "$TOTP" | sed 's/"/""/g; s/.*/"&"/')

        # URL is usually safe, but still escape if needed
        URL_CSV=$(printf '%s' "$URL" | sed 's/"/""/g; s/.*/"&"/')

        # Group and Title should also be escaped
        GROUP_CSV=$(printf '%s' "$GROUP" | sed 's/"/""/g; s/.*/"&"/')
        TITLE_CSV=$(printf '%s' "$TITLE" | sed 's/"/""/g; s/.*/"&"/')

        # Write to CSV
        printf '%s,%s,%s,%s,%s,%s,%s\n' \
            "$GROUP_CSV" \
            "$TITLE_CSV" \
            "$USERNAME_CSV" \
            "$PASSWORD_CSV" \
            "$URL_CSV" \
            "$NOTES_CSV" \
            "$TOTP_CSV" >> "$OUTPUT_FILE"

    done < <(find "$PASS_DIR" -name "*.gpg" ! -name ".gpg" -print)

    echo "All pass entries exported to $OUTPUT_FILE."
}

Note that this bash function was added to a task script and called with ./task export-keepass-csv in context of the .password-store folder.

I am quite happy with the decision to go back using KeePass. The browser plugin and the passkey support are a great help.

Store Passkeys in KeePassXC

Fri, 04 Jul 2025 08:04:42 +0200

The goal of Passkeys is to replace passwords.

The idea is that instead of remembering a password and entering it to access your account, you own a device that generates a password for you.

Remembering is replaced with Owning.

In this post, I’ll give an example of such a device and how you can create and store a Passkey securely.

YubiKey

A device that can be used as a Passkey is the YubiKey. Setting it up is actually quite simple. In this example, we have an online account and are going to set up the Passkey. In the security settings of the online account, I click Add Passkey, and the browser prompts for an input:

The YubiKey is plugged in, I touch the YubiKey, and the device is registered. That’s it. From now on, when I log into my account, as a login option, I can choose Passkey. The browser prompts for the input, I touch the YubiKey, and get logged in.

However, at this point, you might ask: What happens when I lose the YubiKey? Can I make a backup of the key?

The short answer is: You cannot create a backup of a YubiKey.

So, the YubiKey might not be the best solution to use as a Passkey. Luckily, there are other providers and devices to manage a Passkey.

KeePassXC

Here, I will show you how you can create and store a Passkey with KeePassXC.

Install KeePassXC
Set up a password database
In the settings, enable the browser integration and select your browser
Install the KeePassXC browser extension
Connect the extension to your KeePassXC database
Enable the Passkeys option in the KeePassXC browser extension settings
Optionally, set the Default group for saving new passkeys field

You may need to restart your browser for the changes to take effect. When you register a new Passkey for your account, the KeePassXC extension will open the KeePassXC database locally and show this dialog:

You can click Register, and then you’ll find a Passkey entry in your KeePassXC database.

Logging into your account with a Passkey is simple. Select the Passkey option, and the KeePassXC extension will find a matching entry and prompt to authenticate.

Click Authenticate, and you should be logged in.

The KeePassXC database can be backed up, and while Passkey entries can technically be exported, it’s crucial to understand the security implications before doing so.

Recommendations

When registering a Passkey for your account, I recommend using both KeePassXC and YubiKey. The main reason is the mobile browser of your smartphone. Setting up the KeePassXC Passkey solution on your smartphone is currently not possible (as far as I know).

The YubiKey can be plugged into the smartphone’s USB-C port and used to authenticate with any mobile browser. Here is a simple webpage that shows Passkey device and browser compatibility: https://www.passkeys.io/compatible-devices

Using pass in teams

Tue, 03 Apr 2018 08:29:22 +0000

Introduction

Pass is the standard password manager for Unix systems. It follows the Unix philosophy.

Pass saves passwords in text files and encrypts them using a gpg key. The folder structure containing the encrypted files is the pass store. Sharing a pass store without handing over the gpg key requires a gpg key exchange. Git is integrated into the pass cli and is used as version control system.

This document is a guideline for users which require access to a shared pass store and is also a documentation of how to set up a shared pass store. The first part elaborates the process of creating a shared pass store and the second part shows how collaboration from the perspective of a user looks like.

Variables

In the document you will find different variables starting and ending with _ underscore. Below is a description of what those variables mean.

$PROJECT_NAME: A unique name for the shared pass store folder.
$GIT_REMOTE_URL_: Remote url of the shared pass store git repository.
$PERSONAL_MAIL: Personal mail address which is used as gpg key id.
$TEAM_MAIL: Shared team mail address which is used for the shared gpg key id.

Setup a shared pass store

Install pass using the package manager of your choice and setup a new personal store.

Install pass using yum.
yum install pass

If you do not have a personal gpg key, create one. Make sure to set a correct mail address.
gpg --gen-key

Initialize a personal pass store.
pass init $PERSONAL_MAIL

Passwords are encrypted with a gpg key. In a team environment the gpg key should not impersonate somebody but rather the team itself. That is why a new gpg key is required.

gpg --gen-key
# Real name:
> $TEAM_MAIL
# Email address:
> $TEAM_MAIL
# Confirm
> O
# Enter the password
> _PASSWORD_

Create a new pass store in a subfolder.
pass init -p $PROJECT_NAME $TEAM_MAIL

Add the gpg test password to the new store.
pass generate $PROJECT_NAME/sharedpass 20

Setup a git repo for the shared pass store.

cd ~/.password-store/$PROJECT_NAME
git init
git add .
git commit -m "Init $PROJECT_NAME password store"
git remote add origin $GIT_REMOTE_URL_
git push --set-upstream origin master

Add the gpg public key to the store.

mkdir .gpg-keys
gpg --output .gpg-keys/$TEAM_MAIL.gpg --export $TEAM_MAIL
git add $TEAM_MAIL.gpg
git commit -m "Add $TEAM_MAIL public key"
git push

The remote repo can be cloned as a subfolder into the existing pass store folders. Git will treat the subfolder as a git submodule.

Request access to shared pass store

In the following steps we assume that another member of the team requires access to the shared pass store.

Clone the shared pass store repository.
git clone $GIT_REMOTE_URL_ ~/.password-store/$PROJECT_NAME

The shared pass store is now available as subfolder to your personal pass store. If you have enabled git for the personal pass store the subfolder will be treated as git submodule. Changes in the shared pass store will not affect your personal store.

In order to be able to decrypt the passwords in the shared pass store, the store key must be signed by the personal gpg key.

List your gpg keys.
gpg --list-key

Add the personal key to the shared pass store.
echo "$PERSONAL_MAIL" >> ~/.password-store/$PROJECT_NAME/.gpg-id

And export the public gpg key.
gpg --output ~/.password-store/$PROJECT_NAME/.gpg-keys/$PERSONAL_MAIL.gpg --export $PERSONAL_MAIL

Then submit a request by committing the gpg id.

cd ~/.password-store/$PROJECT_NAME
git add .
git commit -m "Request access for $PERSONAL_MAIL"
git push

The receiver of this request is the owner of the shared pass store signer key $TEAM_MAIL.

Grant access to users

The owner of the signer key must sign all keys of new team members.

First import the new keys.

cd ~/.password-store/$PROJECT_NAME/.gpg-keys
gpg --import $PERSONAL_MAIL.gpg

Then sign the imported key.

gpg --local-user $TEAM_MAIL --sign-key $PERSONAL_MAIL
gpg --edit-key $PERSONAL_MAIL
# Confirm
> y
# enter the passphrase for $TEAM_MAIL
> save

Reinitialize the password store.
pass init -e -p $PROJECT_NAME $(cat ~/.password-store/$PROJECT_NAME/.gpg-id)

Push the changes.

cd ~/.password-store/$PROJECT_NAME
git push

The user should now be able the decrypt the password using the $PERSONAL_MAIL key.

Contribute to a shared pass store

New password insertions must be encrypted with the $TEAM_MAIL gpg key.

The gpg key can be imported from the shared pass folder.

cd ~/.password-store/$PROJECT_NAME/.gpg-keys
gpg --import $TEAM_MAIL.gpg

In order to encrypt new pass entries, you must trust the key.

gpg --edit-key $TEAM_MAIL.gpg
> trust
> 5
# exit the cli

Now you can start creating new entries using the pass cli.

Notes

If there is a gpg registry you can obtain the public keys from there. There would be no need to exchange public key as files.

Updates

2019-10-16 Edit: Renamed the variables with a ‘$’ prefix. Ensuring bash compatiblity.
2019-10-16 Edit: Updated guide for latest pass version.

Sources

Official pass homepage

Medium - Using pass in a team

XKCD PowerShell password generator

Fri, 11 Aug 2017 13:04:45 +0000

Through 20 ears of effort, we’ve successfully trained everyone to use passwords that are hard for humans to remember, but easy for computers to guess.

If you are a Hacker News binge reader such as me, you might have read this article: The Guy Who Invented Those Annoying Password Rules Now Regrets Wasting Your Time.

This article reminded my of how stupid current password guidelines are and that we need to change that. A few months ago I wrote a random password generator function and decided that it needs an update to make the generated passwords more memorable.

Inspiration for the new random password was the following XKCD comic:

So instead of using any kind of character for the password, simply put four random words together. To create this kind of password we need a word list with common nouns. I’ve created a german and english word list for you to download:

wordlist.de.txt wordlist.en.txt

Get-XKCDPassword.ps1

And here is the PowerShell function:

function Get-XKCDPassword {

    Param(
        [int]$words = 4,

        [string]$delimiter = "-",

        [ValidateSet("en","de")] 
        [string]$lang = "en",

        [switch]$FirstLetterUpperCase  
    )
    
    $password = ""
    $wordlist = @{
        de = "/wp-content/uploads/2017/08/wordlist.de_.txt"
        en = "/wp-content/uploads/2017/08/wordlist.en_.txt"
    }
    
    switch($words) {
        {$_ -ge 6 } { throw "Word parameter cannot be greater or equal 6." }
        5 { $range = (3,4) }
        4 { $range = (4,5) }
        3 { $range = (5,6) }
        2 { $range = (7,8) }
        {$_ -le 1 } { throw "Word parameter cannot be less or equal 1." }
    }

    $list = (((Invoke-WebRequest $wordlist[$lang]).Content -split "`n" | ForEach-Object{ 
        New-Object PSObject -Property @{
            Value = $_.ToLower()
            Length=$_.length
        }
    }) | Where-Object { ($_.Length -eq ($range[0] + 1)) -or ($_.Length -eq ($range[1] + 1)) })

    1..$words | ForEach-Object {
        $part =  (Get-Random $list).Value.Trim()

        if($FirstLetterUpperCase ) {
             $password += ((Get-Culture).TextInfo).ToTitleCase($part)
        } else {
            $password += $part
        }

        if($_ -lt $words){ 
            $password += $delimiter 
        }
    }

    return $password
}

Get-XKCDPassword -words 4 -delimiter "-" -lang "de" -FirstLetterUpperCase

Here are some results:

bite-bomb-pupil-basis
crime-wedge-alley-roll
side-filly-bloom-fairy
read-tribe-mouth-jail
knot-make-child-moth

And a few more in german:

Seite-Sorge-Saft-Nadel
Fluss-Glas-Alter-Rand
Nord-Maul-Wert-Nabel
Sand-Schal-Anruf-Rand
Sahne-Post-Name-Park

Migrate KeePass to Pass

Mon, 24 Jul 2017 10:05:46 +0000

I’m using KeePass for a few years now. It always has been the password manager of my choice. Currently I’m using KeePass on my Mac and Windows connected to the same database file. The KeePass database file is stored in a OneDrive folder, encrypted with a password and keyfile, which is stored in the Keybase filesystem. This setup gives me maximum security and portability. However, it makes it impossible to use KeePass on my mobile device. Also I miss the possibility to use KeePass in my browser or on the command line. I’ve looked for an alternative solution, which doesn’t compromise on security and gives me the same level of portability.

So I’ve found Pass. The standard Unix password manager. Pass is a command line tool that stores password entries in gpg-encrypted files in a git folder. There is a Windows, Mac, iOS client and a browser plugin. I’ve decided to give it a try. Now I would like to show you how I migrated my KeePass database into the Pass store.

First I’ve exported the database as an XML file. This is only possible with the Windows KeePass client.
On my Mac I’ve set up Pass with a store. You could setup Pass on Windows with Bash on Ubuntu on Windows aka Linux subsystem for windows.
Finally I developed and executed a PowerShell script on my Mac, which migrates the xml data to Pass.

keepass2pass.ps1

[xml]$Content = Get-Content -Path "KeepassData.xml"

function Traverse-Tree ($Node, $ParentPath) {

    $Path = $ParentPath + "/" + $Node.Name
    $ChildNodes = $Node.Group
    $Entries = $Node.Entry

    if($Entries -and ($Node.Name -notcontains "Recycle Bin")) {
        foreach ($Entry in $Entries) {
            $Content = ""
            $Title = ""
            $Password = ""
            foreach ($Field in $Entry.String) {
                switch($Field.Key) {
                    "Title" { $Title = $Field.Value }
                    "Password" { $Password = $Field.Value.'#text' }
                    default {
                        $Content += "$($Field.Key): `"$($Field.Value)`"`n"
                    }
                }
            }
            @{
                Path = $Path + "/" + $Title
                Content = $Password + "`n" + $Content
            }
        }
    }

    if($ChildNodes) {
        foreach ($ChildNode in $ChildNodes ) {
            Traverse-Tree $ChildNode $Path
        }
    }
}

$PasswordEntries = $Content.KeePassFile.Root.Group.Group | ForEach-Object {
    Traverse-Tree -Node $_ -ParentPath ""
} | ForEach-Object {
    Write-Host "Creating pass entry: $($_.Path)"
    $_.Content | & pass insert -m $_.Path
}

You can get the latest version of this file here: https://gist.github.com/898be0891058ee091dae8c68a8e2b91e

The script is fairly simple. It traverses the database folder tree and extracts all password entries. These entries are then recreated with the pass insert command.

Feel free to use and update the script.

Password Generator with PowerShell

Mon, 07 Sep 2015 15:03:41 +0000

Whenever I had to think of a secure password I followed these steps:

The right order of vocals and consonants makes it more easy to remember a password.
And so do three digits of a number.
Add one uppercase Letter. Likely as the first character.
Add a dot or another sign to expand to vocabulary even more.

As I’am using a PowerShell a lot I’ve created the function/script below to create such a password.

function Get-RandomPasswort{
    
    $numbers = 1..9
    $consonants = "b","c","d","f","g","h","k","l","m","n","p","r","s","t","v","w","x","z"
    $nopeletters = "j","q","y"
    $vocals = "a","e","i","o","u"
    $dotsandstuff = ",",".","-"
    $nopedotsandstuff = ";",":","_"

    return (Get-Random $consonants).ToString().ToUpper() + 
    (Get-Random $vocals) + 
    (Get-Random $consonants) + 
    (Get-Random $numbers) +  
    (Get-Random $numbers) + 
    (Get-Random $numbers) + 
    (Get-Random $vocals) + 
    (Get-Random $consonants) + 
    (Get-Random $vocals) + 
    (Get-Random $dotsandstuff)
}

Get the lastest version of this snippet here: https://gist.github.com/f437d7764a43b9de6c3a

Example

Create 10 new password is easily done.

1..10 | %{Get-RandomPasswort}
Zov683oxa.
Pev541imi-
Pim276ovo-
Vus211ixi.
Dab998inu.
Dup268awi.
Det893ema.
Xok762axa-
Lun996azu,
Gal196ere.

Change Active Directory User Password Expiration Mode

Wed, 11 Dec 2013 17:35:45 +0000

To change an Active Directory users password expiration mode you can use this PowerShell snippet:

Import-Module ActiveDirectory

Get-ADGroupMember "Group1" -Recursive |
Get-ADUser -Properties PasswordNeverExpires |
where {$_.enabled -eq $true -and $_.PasswordNeverExpires -eq $false} |
select -First 50 | %{

    Write-Host $_.UserPrincipalName
    Set-ADUser $_ -PasswordNeverExpires $true
}

Latest version of this snippet: https://gist.github.com/7913696

Handling user password change and expiration issues with Office365 and ADFS – Part 2

Mon, 23 Sep 2013 08:50:49 +0000

https://janikvonrotz.ch/2013/08/08/handling-user-password-change-and-expiration-issues-with-office365-and-adfs-part-1/

This is part two of my experience in handling the password change office365 architecture issue.

Last time I’ve built a simple script to notificate the users about the status of their passwords. In the mean time we (me and another employ of the “vbl Informatik”) built a simple website for the office365 users to change their password.

The whole project is now available on https://codeberg.org/janikvonrotz/ActiveDirectory-Password-Change

Checkout the instructions in the readme fileto set up the password change website.

If you have setup the website already I recommend you to include the site with a sharepoint webpart here’s an example:

Handling user password change and expiration issues with Office365 and ADFS - Part 1

Thu, 08 Aug 2013 14:41:37 +0000

Recently I’ve setup a Office365 Service with ADFS (Active Directory Federation Service) and a DirSync Server.

Sadly I forgot about a huge disadvantage in this architecture, due to using ADFS as an authentication provider, it’s not possible to change a users password. The communication form the local ActiveDirectory environment to the cloud based Office365 services is only one directional.

That’s why there are only 2 options yet to handle the user password change and expiration:

At this time option 1 is active in my environment and option 2 is my goal.

In this post series want to show you the solution I’ve developed.

Let’s start with password expiration. Because Office365 doesn’t handle password expiration, that’s why I have to use another channel to show the users on which date their passwords expire: Let’s do it with an bulk e-mail job.

This part isn’t a lot of effort. There are 2 requirements, one is a must and the other is optional:

Now the script:

<#
$Metadata = @{
	Title = "Send Password Expiration Reminder"
	Filename = "Send-PasswordExpirationReminder.ps1"
	Description = ""
	Tags = "powershell, script, jobs"
	Project = ""
	Author = "Janik von Rotz"
	AuthorContact = "http://.janikvonrotz.ch"
	CreateDate = "2013-08-08"
	LastEditDate = "2013-11-25"
	Version = "2.1.0"
	License = @'
This work is licensed under the Creative Commons Attribution-NonCommercial-NoDerivs 3.0 Unported License.
To view a copy of this license, visit http://creativecommons.org/licenses/by-nc-nd/3.0/ or
send a letter to Creative Commons, 444 Castro Street, Suite 900, Mountain View, California, 94041, USA.
'@
}
#>

try{

    #--------------------------------------------------#
    # modules
    #--------------------------------------------------#    
    Import-Module ActiveDirectory
	
    #--------------------------------------------------#
    # settings
    #--------------------------------------------------#   
    $TriggerDays = 25, 10, 5, 1
    $SendLinkOnDays = 25,10, 5, 1
	$DaysBeforeDisablingUsersWithPasswordNeverExpires = 180
	$ADGroup = "S-1-5-21-1744926098-708661255-2033415169-36648" # Memberof GroupName should be "SPO_PasswordNotification"   
    
    #--------------------------------------------------#
    # main
    #--------------------------------------------------#

    # get mail config         
    $Mail = Get-PPConfiguration $PSconfigs.Mail.Filter | %{$_.Content.Mail | where{$_.Name -eq "PasswordReminder"}} | select -first 1

    # get days until password expires
    $MaxDays = (Get-ADDefaultDomainPasswordPolicy).MaxPasswordAge.Days 
    if($MaxDays -le 0){throw "Domain 'MaximumPasswordAge' password policy is not configured."}

    # Set days when an email should be sent to inform the users
    $TriggerDays = 25, 10, 5, 1
    $SendLinkOnDays = 25,10, 5, 1

    foreach($TriggerDay in $TriggerDays){    
    
        # Memberof GroupName should be "SPO_PasswordNotification"       
        Get-ADGroupMember $ADGroup -Recursive | 
        Get-ADUser -Properties Enabled, lastLogonTimestamp, PasswordNeverExpires, PasswordLastSet, Mail, DisplayName |
        Select *, @{L = "PasswordExpires";E = { 
            if($_.PasswordNeverExpires){
                $DaysBeforeDisablingUsersWithPasswordNeverExpires - ((Get-Date) - ($_.PasswordLastSet)).Days
            }else{
                $MaxDays - ((Get-Date) - ($_.PasswordLastSet)).Days
            }
        }} |
        where{($_.Enabled -eq $true) -and ($_.PasswordExpires -eq $TriggerDay)} | %{ 
                              
            # set subject
            $Subject = "Passwort Erinnerung: $($_.DisplayName) ihr Passwort läuft in $($_.PasswordExpires) Tagen ab"
            
            $BodyFont = "font-size: 11pt; font-family: Calibri"
            
            # create mail message
            $Body = "<p style = ""$BodyFont"">Guten Tag $($_.DisplayName) <br/> <br/> Ihr Passwort läuft am $(Get-Date (Get-Date).AddDays($_.PasswordExpires) -Format D) ab.</b></p>"          
            if($SendLinkOnDays -contains $TriggerDay){            
                $Body += "<p style = ""$BodyFont"">Bitte ändern Sie das Passwort bevor es abläuft. Rufen Sie dazu die folgende Seite auf: <a href=""https://vbluzern.sharepoint.com/Support/_layouts/15/start.aspx#/SitePages/Passwortwechsel.aspx"" target=""_blank"">Link</a></p>"
            }
             $Body += "<p style = ""$BodyFont"">ACHTUNG! Dieses E-Mail wurde von einem unbeaufsichtigtem Konto verschickt, Antworten an den Sender dieser E-Mail werden nicht bearbeitet.</p>"

            # send mail
            Write-PPEventLog "$($MyInvocation.InvocationName)`n`nSend password reminder to $($_.Mail)" -WriteMessage -Source "Send Password Expiration Reminder" 
            Send-MailMessage -To $_.Mail -From $mail.FromAddress -Subject $Subject -Body $Body -SmtpServer $Mail.OutSmtpServer -BodyAsHtml -Priority High -Encoding ([System.Text.Encoding]::UTF8)
        
        }        
    }
   
}catch{

	Write-PPErrorEventLog -Source "Send Password Expiration Reminder" -ClearErrorVariable
}

https://gist.github.com/6184059

For the memberof Group I recommend to use the SID instead of the DN. I’ll show you how the get the SID:


PS C:Userssa-spadmin> (Get-QADGroup "SPO_PasswordNotification").Sid

  BinaryLength AccountDomainSid                                                               Value
  ------------ ----------------                                                               -----
			28 S-1-5-21-1744926098-708661255-2033415169                                       S-1-5-21-1744926098-708661255-2033415169-36648

PS C:Userssa-spadmin> Get-QADUser -MemberOf "S-1-5-21-1744926098-708661255-2033415169-36648"

Part two: https://janikvonrotz.ch/2013/09/23/handling-user-password-change-and-expiration-issues-withoffice365-and-adfs-part-2/