Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

There seems to be a subtle difference between a domain account that has the checkbox "force password change" and an account that merely has an expired password (say after 90 days).

Is there a way to simulate / force an account to "expire" other than changing the policy and impacting all accounts? Are there differences based on the functional level of the domain?

share|improve this question
up vote 4 down vote accepted

You can set the user's pwdlastset attribute to a specific date/time therefore making it expired. You can do that using powershell, wsh, vbs, ... Note however that the format of the field is Integer8

share|improve this answer

In both cases the password must be changed but the difference is that when a password has expired it can no longer be used for authentication, whereas one that requires changing is still valid. As you say, it's subtle.

For testing I would suggest creating a new policy to apply to just a test account and setting the expiry period to something short enough to be useful for that testing.

share|improve this answer

The end result is the same, the passwords for the user has to be changed.

You could use a powershell script to change the setting for all users on the domain.

There are no differences based on the functional level. The functional level only tells the domain which version of the domain controllers can be on the domain.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.