How to disable “Password Never Expires” on multiple users (Windows Server 2003)

Question

It seems that a lot of my users have the "Password Never Expires" box checked. And that bypasses my password policy.

I have all my users under one OU folder, with a lot of subfolders of course. And I am looking for a way to remove box check in "password never expires" for all the users under that main OU folder.

And the best way to do that is ........ I don't know.

Any help would be very much appreciated

Answer 1

Edit: Let's do this a little differently, then.

Assuming you're using the Windows 2003 version of Active Directory Users and Computers:

• At the "Saved Queries" node at the top of AD, do a "New" / "Query".

• Name the query whatever you'd like and supply a description if you'd like. In the query definition, choose the OU above the user accounts for the "Query root".

• Click "Define Query". In the "Find Common Queries" dialog, choose "Has a value" from the drop-down list to the right of the "Name" caption on the "Users" tab. Click "OK" and "OK" again to define the query.

• Highlight your newly-created query and right-click and choose "Refresh" (or press F5) if the query isn't populating the right pane.

• Highlight users in the right-pane, right-click and choose "Properties". Go to the "Account" tab, click the lefthand checkbox beside "Password Never Expires" and leave the check-box to its right (which will become enabled after you click the lefthand check box) empty.

Answer 2

Another way to do it is to write a VBScript that would go through and unset that option on each of the user accounts.

If you want to go down that route... here are a few scripts that are 90% of the way there

http://windowsitpro.com/article/articleid/48309/how-can-i-determine-which-users-have-the-password-never-expires-flag-set-on-their-account.html

http://www.microsoft.com/technet/scriptcenter/resources/qanda/oct06/hey1031.mspx

http://support.microsoft.com/kb/305144

Answer 3

Beware if you're doing a script: I once tried to get too clever here and cooked up something to dump them out to Excel and run a mail merge through Outlook to notify the users affected. I ended up addressing our top person by her first name on written record as a result of it; wasn't too bad but that depends on who your top person is...!