Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there a way from either the computer management console or the command line to determine when a user's password will expire?

Note: I'm asking this questions for a server that is not part of a domain.

share|improve this question

2 Answers 2

up vote 9 down vote accepted

This can be achieved by the DOS/Batch command

net user username

If you were on a domain you would need to add the switch /Domain. In your case, just insert the username.

This will list the most important details of that account, including the expiry date of the user password.

share|improve this answer
    
Just as additional information: You can also set the expiry date via this command, should you need to do that. See "net user /help" for all info –  LumenAlbum Aug 28 '12 at 14:59

If you're chasing the same problem I had in the past, users want better warning of when their password is going to expire, especially when they're away from a typical PC. The following is the script I run every 72 hours (3 days) to e-mail warnings.

# © 2011 Chris Stone, Beerware Licensed
# Derived from http://www.jbmurphy.com/2011/09/22/powershell © 2011 Jeffrey B. Murphy

import-module ActiveDirectory

$warningPeriod = 9
$emailAdmin = "admin@example.com"
$emailFrom = "PasswordBot." + $env:COMPUTERNAME + "@example.com"
$smtp = new-object Net.Mail.SmtpClient("mail.example.com")

$maxdays=(Get-ADDefaultDomainPasswordPolicy).MaxPasswordAge.TotalDays
$summarybody="Name `t ExpireDate `t DaysToExpire `n"

(Get-ADUser -filter {(Enabled -eq "True") -and (PasswordNeverExpires -eq "False")} -properties *) | Sort-Object pwdLastSet | foreach-object {

    $lastset=Get-Date([System.DateTime]::FromFileTimeUtc($_.pwdLastSet))
    $expires=$lastset.AddDays($maxdays).ToShortDateString()
    $daystoexpire=[math]::round((New-TimeSpan -Start $(Get-Date) -End $expires).TotalDays)
    $samname=$_.samaccountname
    $firstname=$_.GivenName

    if (($daystoexpire -le $warningPeriod) -and ($daystoexpire -gt 0)) {
        $ThereAreExpiring=$true

        $subject = "$firstname, your password expires in $daystoexpire day(s)"
        $body = "$firstname,`n`nYour password expires in $daystoexpire day(s).`nPlease press Ctrl + Alt + Del -> Change password`n`nSincerely,`n`nPassword Robot"

        $smtp.Send($emailFrom, $_.EmailAddress, $subject, $body)

        $summarybody += "$samname `t $expires `t $daystoexpire `n"
    }
}

if ($ThereAreExpiring) {
    $subject = "Expiring passwords"

    $smtp.Send($emailFrom, $emailAdmin, $subject, $summarybody)
}

Set those four configuration lines appropriately for your environment. Modify other parts as necessary.

PS may complain if the script isn't signed. I signed mine using (I have a code signing certificate):

Set-AuthenticodeSignature PasswordBot.ps1 @(Get-ChildItem cert:\CurrentUser\My -codesigning)[0]

Then I created a simple Scheduled Task, triggers every 72 hours, action is to run C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe with argument C:\Path\To\PasswordBot.ps1.

Note: The computer this script is run on must be a member of the domain, and must have the "Active Director module for Windows PowerShell" installed. You can run start /wait ocsetup ActiveDirectory-PowerShell on any server to install it, or find it in the Features list in Windows 7 (RSAT might be required, I can't remember now).

share|improve this answer
    
This seems to be an awesome script but as you point out it needs to be run on a member of the domain. However, his premise is that the server is not part of a domain. Still great script –  LumenAlbum Aug 28 '12 at 15:06

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.