Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'd like to test a password reset product but need to have expired passwords to do so.

How can I manually set an expiration date for the password, without clicking "must change password"? (since that is technically a different workflow)

share|improve this question

3 Answers 3

Account expiration and password expiration is not the same thing.

Account expiration is a set point in time, after which the account expires - same effect as disabling an account. Authentication fails, even after the password is reset.

Password expiration is not explicitly set on the object, but occurs during authentication when the following conditions are true (the first three values are NT FileTime intervals):

maxPwdAge> 0 && (now() - pwdLastSet> maxPwdAge && !UF_DONT_EXPIRE_PASSWORD)

Where pwdLastSet is the time the account password was last changed, maxPwdAge is the Maximum Password Age in effect for the account.

When you click "must change password", the pwdLastSet attribute is set to 0, which means that the middle part of the above statement is true at any time after Septempter 27th 1603.

So no, it really is the exact same thing - checking "Must change password" and expiring a password manually

share|improve this answer

The account expiration is stored in the accountExpires attribute of the user's LDAP record.

There is an existing StackOverflow topic on how to modify this attribute: PowerShell Add 1 day to the AccountExpire attribute of an AD user

share|improve this answer

There are two ways (I know) to test the password expiry.

  1. Set the maximum password age field of the Default Domain Policy (GPO). If you are using Server with funcational level 2008 or later, you may need to set the maximum password age in the corresponding fine grined password policy (If you have configured fine grained password policies)

  2. Second option is not recommended, but you can try it if you are testing in a virtual machine. The option is change the system time to a future date.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.