Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This is probably very simple but I have been searching for a while and cannot seem to find the answer I need.

I am basically wondering what the switch to set the "Account Expires End of:" option in AD Users and Computers does? Does it just expire the password or does it disable the account?

Also is this likely to conflict with a "Password Never Expires" setting?

share|improve this question
up vote 2 down vote accepted

It means the account cannot logon starting the day after the expiry date. The password is unaffected. The password will be the same after the account is unlocked.

As soon as an administrator removes or extends the expiry date, the account can be used again. It does not get flagged as locked or so.

"Password never expires" has no influence on this mechanic, and vice versa.

Most account status info is in the attribute userAccountControl, which is actually a bitfield, as described here:

But "Account Expires" has its own field, and is calculated separately.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.