Due to mistakes by the helpdesk staff, I found that over a 100 user accounts in my company AD have been set so that their passwords never expire. To avoid the situation in which all these users suddenly find themselves unable to log in, I want to run a script to set the password expiry to a specified date.

I'm using Quest AD cmdlets, but I've only used powershell for simple scripts to get lists of users. The attribute I'm trying to modify is 'PasswordStatus' and I want to set those with this attribute set as "password never expires' to a specific date. Not much of a scripting guy, so any help in this would be most welcome.


A better fix would be to set those 100 accounts to be required to change password on next login (thus not preventing them from logging in), and then a few days later, setting a password age policy (or fine-grained password policies, if you need more than one.)

The first step could be done pretty easily with a CSV input for dsquery, piped into dsmod; keeps it very simple.

The second step will prevent the helpdesk from making this mistake in the future, by taking that part of the process out of their hands.

  • Thanks mfinni. Don't know why I didn't think of that. Simple solutions are the best:) The only possible problem is that lots of users log in via VPN, which authenticates via AD. Not sure how requiring them to change their passwords will affect them logging on to the VPN. – Pierre E Dec 5 '12 at 5:29
  • That will affect them, If you have OWA, you should be able to easily provide them a method to change their password. Depending on your VPN client, that can do it too. – mfinni Dec 5 '12 at 13:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.