Is there a an easy way from the command line (or even just a setting to check somewhere) to see when a password for a local Windows account (specifically Server 2K3) expires or when it was last changed?
The 'net user' command line will do just that:
C:\Documents and Settings\adam>net user adam User name adam Full Name Your Momma Comment User's comment Country code 000 (System Default) Account active Yes Account expires Never Password last set 7/1/2009 10:32 AM Password expires Never Password changeable 7/1/2009 10:32 AM Password required Yes User may change password No Workstations allowed All Logon script User profile Home directory Last logon 8/19/2009 3:24 PM Logon hours allowed All Local Group Memberships *Administrators *Debugger Users *Users Global Group memberships *None The command completed successfully.
Assuming that we're talking about a local account on Windows Server, and not an Active Directory Domain user. Then open cmd.exe and enter the following command:
NET USER username
You'll get a dump of information about the account including the password last set information.
If you want to make it fancier and get back just that information you can pipe the output of net user to the find command:
NET USER username | find "Password last set"
Note for Active Directory accounts: If you're more interested in a domain account you can add the /domain switch to check for the same information. However, due to the distributed nature of AD you may not get the most accurate time from the DC you're asking. The most precise time is stored in the pwd-last-set attribute of the user account, but that requires some manipulation to make sense.