Do Active Directory accounts ever expire?

Question

Business has issued Windows 7 laptops to users who are out in the field for long periods of time where the domain controller is not accessible. There may even be some users who never connect to the domain again since the day their laptop was issued. Would their Active Directory accounts ever expire?

There is an app in development that may require periodic reconnecting to the AD again but I am concerned is it possible AD credentials can expire?

Answer 1

A user account that is expired and a user account that is disabled and a password that is expired are three very different things. A user account never expires without administrative action, whether the user is regularly logging on to the domain or not.

Answer 2

A disconnected computer or user will not "expire" unless you tell it to. A computer or user object will happily stay active in your AD forever if you let it.

Keep in mind that user accounts are subject to your domain's password policy, so a cached account's password might need to be updated when a disconnected user needs to connect to a network resource, but both the user and computer accounts themselves will be fine.

If you need a way to have a disconnected user update their AD password, and you don't have a VPN but you do have Exchange, I usually remind people that they can change their network passwords via OWA.

Answer 3

User/computer passwords CAN expire, cached credentials - No (they will remain indefinitely, it doesn't matter at all if the user or computer account passwords are beyond their expiry date, as long as the credentials have been cached once, and there is no connection to a domain controller, they will never expire).

How long does Windows cache domain user passwords?

If you mean whether AD account can become disabled at some point of time in future automatically - the answer is NO, only due to some conditions listed here.

Answer 4

If the workstations won't connect to the physical LAN again, I don't see a need for having them on your domain in the first place. With that being said, when your user logs into their pc with their domain credentials when they are on the physical LAN and have access to the DCs, their credentials will be cached on the laptop. They would then be able to log into the laptop while off the domain with the cached credentials. To my knowledge, those cached credentials won't expire unless the workstation was able to communicate with a DC from the domain again and the user's current password had expired, was changed, or the account had expired, or was removed.