After I got that actually password doesn't disappear after expiry date, and still there(as mentioned here: Does the password truly expire?)

I would like to know if and how can the system/domain admins - get answer on input string - if that is the old password or not.

(if it is - give to the user permission to select a new password. if not - deny.)

The idea behind the motivation is I want to make my own application for changing password instead the windows default.


System or domain admins cannot access user passwords. Well except when dumping credentials from memory with something like mimikatz that is.

You can however check if the password has expired through various means - such as the Get-ADUser powershell cmdlet: https://docs.microsoft.com/en-us/powershell/module/addsadministration/get-aduser?view=win10-ps

If that is the case he or she can use that password to change or reset their password.

  • I didn't mean that admins try access user passwords. I meant to ask - if admins could get some indication that input password X - is indeed the last password? - even when it's expired (but not replaced yet) – Natan Kara Apr 23 '20 at 13:14
  • No - only the user would be privy to the fact whether the password is correct. However if you code something yourself the error code returned from the domain should indicate that they password is expired rather than incorrect – discondor Apr 23 '20 at 13:31

Set the account useraccountcontrol flag for password never expires, and logon to the account. Then remove the useraccountcontrol flag for password never expires.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.