0

It seems that a lot of my users have the "Password Never Expires" box checked. And that bypasses my password policy.

I have all my users under one OU folder, with a lot of subfolders of course. And I am looking for a way to remove box check in "password never expires" for all the users under that main OU folder.

And the best way to do that is ........ I don't know.

Any help would be very much appreciated

Improve this question

3 Answers 3

Reset to default
5

Edit: Let's do this a little differently, then.

Assuming you're using the Windows 2003 version of Active Directory Users and Computers:

  • At the "Saved Queries" node at the top of AD, do a "New" / "Query".

  • Name the query whatever you'd like and supply a description if you'd like. In the query definition, choose the OU above the user accounts for the "Query root".

  • Click "Define Query". In the "Find Common Queries" dialog, choose "Has a value" from the drop-down list to the right of the "Name" caption on the "Users" tab. Click "OK" and "OK" again to define the query.

  • Highlight your newly-created query and right-click and choose "Refresh" (or press F5) if the query isn't populating the right pane.

  • Highlight users in the right-pane, right-click and choose "Properties". Go to the "Account" tab, click the lefthand checkbox beside "Password Never Expires" and leave the check-box to its right (which will become enabled after you click the lefthand check box) empty.

Improve this answer
3
  • Yeah I am using Windows Server 2003. But it seems that when I select more then one user in the find menu, the properties option goes grey. But in the normal AD Users and Computers window, I can select more then one user and go in to Properties and select the "Password Never Expires"
    – user2792
    Aug 18, 2009 at 15:34
  • Sorry about that. I've dropped on an edit that will do what you want.
    – Evan Anderson
    Aug 18, 2009 at 15:44
  • That is a much better way :)
    – user2792
    Aug 18, 2009 at 15:54
0

Another way to do it is to write a VBScript that would go through and unset that option on each of the user accounts.

If you want to go down that route... here are a few scripts that are 90% of the way there

http://windowsitpro.com/article/articleid/48309/how-can-i-determine-which-users-have-the-password-never-expires-flag-set-on-their-account.html

http://www.microsoft.com/technet/scriptcenter/resources/qanda/oct06/hey1031.mspx

http://support.microsoft.com/kb/305144

Improve this answer
0

Beware if you're doing a script: I once tried to get too clever here and cooked up something to dump them out to Excel and run a mail merge through Outlook to notify the users affected. I ended up addressing our top person by her first name on written record as a result of it; wasn't too bad but that depends on who your top person is...!

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .