5

I'd like to test a password reset product but need to have expired passwords to do so.

How can I manually set an expiration date for the password, without clicking "must change password"? (since that is technically a different workflow)

4 Answers 4

4

Account expiration and password expiration is not the same thing.

Account expiration is a set point in time, after which the account expires - same effect as disabling an account. Authentication fails, even after the password is reset.

Password expiration is not explicitly set on the object, but occurs during authentication when the following conditions are true (the first three values are NT FileTime intervals):

maxPwdAge> 0 && (now() - pwdLastSet> maxPwdAge && !UF_DONT_EXPIRE_PASSWORD)

Where pwdLastSet is the time the account password was last changed, maxPwdAge is the Maximum Password Age in effect for the account.

When you click "must change password", the pwdLastSet attribute is set to 0, which means that the middle part of the above statement is true at any time after Septempter 27th 1603.

So no, it really is the exact same thing - checking "Must change password" and expiring a password manually

1
  • So I just tested this and technically checking the "Must change password" box changes the PasswordLastSet attribute to NULL. Unchecking it sets the attribute to that day's date.
    – Thomas
    Dec 5, 2019 at 17:54
2

The account expiration is stored in the accountExpires attribute of the user's LDAP record.

There is an existing StackOverflow topic on how to modify this attribute: PowerShell Add 1 day to the AccountExpire attribute of an AD user

0

There are two ways (I know) to test the password expiry.

  1. Set the maximum password age field of the Default Domain Policy (GPO). If you are using Server with funcational level 2008 or later, you may need to set the maximum password age in the corresponding fine grined password policy (If you have configured fine grained password policies)

  2. Second option is not recommended, but you can try it if you are testing in a virtual machine. The option is change the system time to a future date.

0

accountExpires This is not the same as the date for which a password will expire due to domain policy based on the natural age of the password. This is a manual expiration date of a password for a particular user set by an administrator.

So setting it to "must change at next logon" is the only way I see to expire a password without either:

1-Waiting the time before it expires naturally via domain policy. 2-Changing (shortening) the domain policy to make it expire naturally.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .