7

I am looking to query AD via Powershell in order to see all user accounts within my forest who have their password set to never expire.

I found a few scripts online using a quick google search but none of them appear to work as expected. I then found the following on technet (https://technet.microsoft.com/en-us/library/finding_users_whose_password_never_expires%28v=ws.10%29.aspx) however when I run the line:

Search-ADAccount -PasswordNeverExpires | FT Name,ObjectClass -A

I only receive a very small number of results and I know that the list returned is missing a large number of users who I know have this option set.

Please can someone tell me what is incorrect with this script or what the reason for the small result set could be?

8
  • 1
    Try Get-ADUser -filter * -Properties PasswordNeverExpires | select name,Pass wordNeverExpires | Where-Object {$_.PasswordNeverExpires -like "True"} does that give you the same results as search-adaccount?
    – Drifter104
    Oct 20, 2015 at 11:56
  • I'm wondering if it is permission to various OUs that is causing the issues
    – Drifter104
    Oct 20, 2015 at 12:02
  • I am running the powershell as administrator with a domain admin account and I get the same results as before. Oct 20, 2015 at 13:09
  • You shouldn't need to run it as administrator. Try not doing so
    – Drifter104
    Oct 20, 2015 at 14:43
  • 1
    Also, try this: (Get-ADUser -LDAPFilter '(&(objectCategory=person)(objectClass=user))' -Properties msDS-UserPasswordExpiryTimeComputed | ?{($_.'msDS-UserPasswordExpiryTimeComputed' -eq 0) -or ($_.'msDS-UserPasswordExpiryTimeComputed' -eq 9223372036854775807)})
    – EliadTech
    Oct 20, 2015 at 15:07

3 Answers 3

9

I use the below to and it works.

get-aduser -filter * -properties Name, PasswordNeverExpires | where { $_.passwordNeverExpires -eq "true" } | where {$_.enabled -eq "true"} 

It searches against AD database to find user's with "PasswordNeverExpires" set to "True" then returns the results in the Powershell console.

edit for wording and wrong cmdlet and to add the below To cleanup the results add this to the end of the above powershell code

| Format-Table -Property Name, PasswordNeverExpires -AutoSize
4
  • Hi Art, Thanks this appears to have worked, I have checked a number of the OUs I know have this option checked and they are now pulling through into the list. Oct 20, 2015 at 15:03
  • I'd recommend condensing your where statement into a single where that handles both operations.
    – Colyn1337
    Oct 20, 2015 at 16:01
  • haha you know I never thought of doing that. That powershell code was put together quickly some time ago and I never looked it back over for improvements. Thanks for the recommendation. Oct 20, 2015 at 16:10
  • get-aduser -filter * -properties Name, PasswordNeverExpires | where { $_.passwordNeverExpires -eq "true" -and $_.enabled -eq "true"} | Format-Table -Property Name, PasswordNeverExpires -AutoSize Oct 20, 2015 at 16:11
5

You could use something like this:

Get-ADUser -filter { (PasswordNeverExpires -eq $true) -and (enabled -eq $true)} -searchbase "OU=,OU=,DC=,DC=" -Properties Surname,givenname, userprincipalName,PasswordNeverExpires| FT Name,ObjectClass,PasswordNeverExpires -A
4
  • 1
    Hi Sorcha, I receive the same number of users as the original line, yet there are users in AD with this property set that do not appear in the results Oct 20, 2015 at 13:06
  • Be sure having the rights on the OUs you want to list. In the filter, you can add surname -eq "<surname of one user don't appear>"
    – Sorcha
    Oct 20, 2015 at 13:14
  • 1
    As mentioned I have full access to all OUs in the domain. However even if I specifically target an OU with 5 users and run your script I only get back 1 user in the results. Even though all 5 users have the property set to true. This is very bizarre. Oct 20, 2015 at 13:35
  • Upvoted for using -Filter in your Get-ADUser which will be much faster than returning all users and filtering in the pipeline
    – Garrett
    Sep 15, 2020 at 1:00
1

Since I'm running on multi-domain env:

$domains = (Get-ADForest).domains
$Members = foreach ($domain in $domains) {
    Get-ADUser -server $domain -filter {PasswordNeverExpires -eq "TRUE"} -Properties PasswordNeverExpires | select name,samaccountname,PasswordNeverExpires,mail | Where-Object {$_.PasswordNeverExpires -like "True"} |Export-Csv -Path "c:\temp\Never_Expire-$domain.csv" -NoTypeInformation }

For single domain:

Get-ADUser -filter {PasswordNeverExpires -eq "TRUE"} -Properties PasswordNeverExpires | select name,samaccountname,PasswordNeverExpires,mail | Where-Object {$_.PasswordNeverExpires -like "True"} |Export-Csv -Path "c:\temp\Never_Expire.csv" -NoTypeInformation }

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .