0

After I got that actually password doesn't disappear after expiry date, and still there(as mentioned here: Does the password truly expire?)

I would like to know if and how can the system/domain admins - get answer on input string - if that is the old password or not.

(if it is - give to the user permission to select a new password. if not - deny.)

The idea behind the motivation is I want to make my own application for changing password instead the windows default.

2 Answers 2

0

System or domain admins cannot access user passwords. Well except when dumping credentials from memory with something like mimikatz that is.

You can however check if the password has expired through various means - such as the Get-ADUser powershell cmdlet: https://docs.microsoft.com/en-us/powershell/module/addsadministration/get-aduser?view=win10-ps

If that is the case he or she can use that password to change or reset their password.

2
  • I didn't mean that admins try access user passwords. I meant to ask - if admins could get some indication that input password X - is indeed the last password? - even when it's expired (but not replaced yet)
    – Natan Kara
    Apr 23, 2020 at 13:14
  • No - only the user would be privy to the fact whether the password is correct. However if you code something yourself the error code returned from the domain should indicate that they password is expired rather than incorrect
    – discondor
    Apr 23, 2020 at 13:31
0

Set the account useraccountcontrol flag for password never expires, and logon to the account. Then remove the useraccountcontrol flag for password never expires.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .