Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to test a password reset product but need to have expired passwords to do so.

How can I manually set an expiration date for the password, without clicking "must change password"? (since that is technically a different workflow)

share|improve this question

Account expiration and password expiration is not the same thing.

Account expiration is a set point in time, after which the account expires - same effect as disabling an account. Authentication fails, even after the password is reset.

Password expiration is not explicitly set on the object, but occurs during authentication when the following conditions are true (the first three values are NT FileTime intervals):

maxPwdAge> 0 && (now() - pwdLastSet> maxPwdAge && !UF_DONT_EXPIRE_PASSWORD)

Where pwdLastSet is the time the account password was last changed, maxPwdAge is the Maximum Password Age in effect for the account.

When you click "must change password", the pwdLastSet attribute is set to 0, which means that the middle part of the above statement is true at any time after Septempter 27th 1603.

So no, it really is the exact same thing - checking "Must change password" and expiring a password manually

share|improve this answer

The account expiration is stored in the accountExpires attribute of the user's LDAP record.

There is an existing StackOverflow topic on how to modify this attribute: PowerShell Add 1 day to the AccountExpire attribute of an AD user

share|improve this answer

There are two ways (I know) to test the password expiry.

  1. Set the maximum password age field of the Default Domain Policy (GPO). If you are using Server with funcational level 2008 or later, you may need to set the maximum password age in the corresponding fine grined password policy (If you have configured fine grained password policies)

  2. Second option is not recommended, but you can try it if you are testing in a virtual machine. The option is change the system time to a future date.

share|improve this answer

accountExpires This is not the same as the date for which a password will expire due to domain policy based on the natural age of the password. This is a manual expiration date of a password for a particular user set by an administrator.

So setting it to "must change at next logon" is the only way I see to expire a password without either:

1-Waiting the time before it expires naturally via domain policy. 2-Changing (shortening) the domain policy to make it expire naturally.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.