Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to use PowerShell to change local user settings on Windows XP (without Active Directory), specifically the settings on the user properties tab - such as "Password never expires" and groups that the user is a member of?

Samples would be great, but a pointer to the relevant documentation would be great too - I'm not even sure what to look for.

share|improve this question
up vote 2 down vote accepted

The simplest way is to direct ADSI queries to the local WinNT provider - that will return local objects on the system you are interested in. These can be local or remote systems but this will attach to the local account and security objects rather than the AD.

$user = [ADSI]"WinNT://joe-pc/joe"

With that you can then query and modify properties of the $user object.

To set the "Password Doesn't expire" Flag you need to set the relevant flag in the UserFlags attribute. You can find a useful table of these at Motobit here.

To forcibly set Joe's account password from the above example to never expire:

$user.UserFlags.value=$user.UserFlags.value -bor $Never_Expire

Modifying group memberships is a bit more involved but Microsoft's PowerShell Guy has a step by step walk though for adding Domain User accounts to a Local Group on a system which I think is exactly what you need.

share|improve this answer

heres a way to turn off Password Never expires by connecting to each machine..

share|improve this answer

PS version 2.0

$user = [ADSI]"WinNT://ComputerName/User"
$user.UserFlags = 65536 // Flag value used to set password to not expire

Great reference -

share|improve this answer

I'm not sure how to do exactly what you asked, but the MS Getting Started documentation is here:

share|improve this answer

These did not work for me so after much searching and much trial and error I came up with this to remove password never expires from the local administrator account, based on SID, and local guest account, based on SID.

#Set local administrator's password to expire
$admin = (gwmi -query "Select * From Win32_UserAccount Where LocalAccount = TRUE
                       AND SID LIKE 'S-1-5%-500'").Name
wmic useraccount where "name='$admin'" set passwordexpires=true

#Set local guest's password to machine expire
$guest = (gwmi -query "Select * From Win32_UserAccount Where LocalAccount = TRUE
                       AND SID LIKE 'S-1-5%-501'").Name
wmic useraccount where "name='$guest'" set passwordexpires=true
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.