On a Windows platform, is there any command line utility that I can pass a username, password domain name to in order to verify the credentials (or possibly give an error that the account is disabled, doesn't exist or expired)?

  • 2
    Why would you need to verify anyone's credentials but your own. As a responsible and respectable SysAd, you have no need to know anyone else's credentials (except perhaps root or the Domain Admin accounts). – gWaldo Jul 23 '12 at 10:34
  • 6
    @gWaldo: I came here as a software engineer who is writing an installer program which asks a user for the credentials of an existing machine account, which we then subsequently store (encrypted) for code-level Win32 API impersonation calls. I found this question and answer relevant and useful, as well as legitimate. – Mike Atlas Oct 10 '12 at 13:44
  • 1
    I set up users with a default password and instructed them to change it. Now a couple weeks later, I want to know who has and who hasn't. – Mark Berry Oct 21 '14 at 21:44
  • @MarkBerry you should just tick the checkbox in the user profile forcing them to change their password on the next logon. – Craig Sep 25 '15 at 8:24
  • 2
    @Craig, even if I force them to change their password at login, that still doesn't guarantee that they have logged in a week or a month later; I need a way to check from the command line. Forced password change can even lock out remote users if Network Level Authentication is enabled. And sometimes, the company (customer) requires a softer touch than forcing a password change. – Mark Berry Sep 25 '15 at 22:13

You could use the net use command, specifying the username and password on the command-line (in the form net use \\unc\path /user:username password and check the errorlevel returned to verify if a credential is valid.

The runas command would work, too, except that you're going to have a tougher time testing the output.

Testing a credential for the existence of an account would be a matter of using net user or dsquery. The net user command won't tell you if an account is locked out, but querying the lockoutTime attribute of the user account could tell you that.

  • 6
    runas /user:username cmd will open a new command line window as username if you provide the valid password and that user can login to this computer. I commonly will open a shell to test that the password is still the default based on their personal info that I can look up. – PsychoData Feb 10 '15 at 21:41

In Powershell:

Function Test-ADAuthentication {
    (new-object directoryservices.directoryentry "",$username,$password).psbase.name -ne $null

PS C:\> Test-ADAuthentication "dom\myusername" "mypassword"
PS C:\>

Reference: https://stackoverflow.com/questions/7663219/how-to-authenticate-an-user-in-activedirectory-with-powershell

  • I'm getting ObjectNotFound: (Test-ADAuthentication:String) [], CommandNotFoundException here. Does this exclusively work on a domain controller and not for local accounts? – SaAtomic Jun 12 '17 at 5:41
  • 1
    @SaAtomic You need to define the function in your session before running it. Test-ADAuthentication is not built into powershell – Kolob Canyon Sep 27 '17 at 19:51
  • 1
    One thing I really don't like about your answer is you don't read the password in as a secure string. Plain text passwords are always a bad idea. $pass = Read-Host -assecurestring 'Enter password' – Kolob Canyon Sep 27 '17 at 19:52

Just wanted to add that since AD is an LDAP server, you can use an LDAP command line tool to 'bind' to it, thus confirming whether or not it is active. You can also bind as a user with higher privileges and then seach AD using LDAP principles.

But hey-- nothing wrong with Powershell!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.