Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I query AD to give me all users that are enabled, but not expired? I use the QuestAD tools with PowerShell but it doesn't have a "-NotExpired" option or equivalent with Get-QADUser.

I would prefer a PowerShell solution if possible to make it easier for me to play with the data.

share|improve this question
up vote 1 down vote accepted
Get-QADUser -Enabled -SizeLimit 0 | where {-not $_.AccountIsExpired}
share|improve this answer
Bah, old question that has been answered. – Doug Luxem Sep 3 '09 at 14:04

Never mind - seems the object itself has a boolean "AccountIsExpired" flag I can test for.

share|improve this answer
Glad you've resolve this issue. Please be sure to mark your answer as "accepted" when you are able. – jscott Jul 25 '12 at 1:09

Get-QADUser -Enabled -AccountNeverExpires -SizeLimit 0

share|improve this answer
Doesn't cover accounts that are enabled and have an expiry date set in the future - which I want to see. – Neobyte Aug 20 '09 at 5:06
Check this parameters as well: -AccountExpiresAfter <DateTime> -AccountExpiresBefore <DateTime> You can also reverse AccountNeverExpires: -AccountNeverExpires:$false – Shay Levy Aug 20 '09 at 16:39

You should be able to do this with a ADO ADSI query:


will give all the non-disabled accounts that don't expire.


will give you all of the non-disabled user objects that expired before 1/16/2006

Here's an example of how to do an ADO ADSI query:

$strbase = "<LDAP://dc=ms,dc=com>" 
$strFilter = "(&(objectcategory=user)(useraccountcontrol=66048))" 

$strAttributes = "sAMAccountName,displayname" 
$strScope = "subtree" 
$strQuery = "$strBase;$strFilter;$strAttributes;$strScope" 

$objConnection = New-Object -comObject "ADODB.Connection" 
$objCommand = New-Object -comObject "ADODB.Command" 
$objCommand.ActiveConnection = $objConnection 
$objCommand.CommandText = $strQuery 
$objRecordSet = $objCommand.Execute()

And according to this post... you'll get the answer much quicker this way then you would with a cmdlet. Also here is a great guide to ADO ADSI, it's references VBscript examples, but you can easily translate the concepts back to Powershell.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.