0

I am trying to get a list of all the users in our domain and their password expiration dates Server OS Windows server 2008 Any ideas or suggestions?

2 Answers 2

2

There's a lovely computed attribute you can query for each user called msDS-UserPasswordExpiryTimeComputed. You can use the native Active Directory powershell modules to query it with the Get-ADUser command like this:

Import-Module ActiveDirectory
Get-ADUser -Filter * -SearchBase 'DC=example,DC=com' -Prop msDS-UserPasswordExpiryTimeComputed | 
Select Name,msDS-UserPasswordExpiryTimeComputed

However, the attribute is returned as a FileTime value which isn't very human friendly. So we add some formatting to our output to convert the value into an actual DateTime object like this.

Get-ADUser -Filter * -SearchBase 'DC=example,DC=com' -Prop msDS-UserPasswordExpiryTimeComputed | 
Select Name,@{L='PassExpiry';
              E={[DateTime]::FromFileTime($_."msDS-UserPasswordExpiryTimeComputed")}}

Now you may notice that some of your users don't have anything listed in the PassExpiry column. That's most likely because their passwords are configured to never expire and that FileTime value converted to a DateTime exceeds the maximum value for a DateTime and the conversion failed. If you're doing calculations on or sorting these expiry values, it's usually helpful to not have empty values in your results. So we can add a bit more conditional logic to our customized select statement and just set those values to DateTime.MaxValue.

Get-ADUser -Filter * -SearchBase 'DC=example,DC=com' -Prop msDS-UserPasswordExpiryTimeComputed | 
Select Name,@{L='PassExpiry';E={
    $ft = $_.'msDS-UserPasswordExpiryTimeComputed';
    if ($ft -gt [DateTime]::MaxValue.ToFileTime()) {
        [DateTime]::MaxValue
    } else {
        [DateTime]::FromFileTime($ft)
    }
}}
3
  • +1 for this. Excellent solution with a very good output and superbly explained. I learned something new from this as well, msDS-UserPasswordExpiryTimeComputed - Thanks :) I would however choose to adda pipe to export-csv at the end as the output can be rather long :) Nov 2, 2016 at 7:41
  • Oh yeah, export-csv for sure if this is as far as you're going. But you may also want to sort or take additional action on some accounts based on the dates that come back. The beauty of powershell having everything in the pipeline is that it's really easy to keep "doing stuff" to the resulting output. Nov 2, 2016 at 18:16
  • The other really nice thing about msDS-UserPasswordExpiryTimeComputed is that it accounts for any fine-grained password policies that might be applied to the user. About the only bad thing is that the attribute name is so long. Nov 2, 2016 at 18:18
0

First get a list of the usernames.

Then you can retrieve their password expiration dates using DOS/Batch like this:

net user %USERNAME% /domain

You can also search for when all users are expiring within a certain time frame, like 90 days:

Search-ADAccount -AccountExpiring -TimeSpan 90.00:00:00 | where {$_.ObjectClass -eq 'user'} | FT Name,ObjectClass –A

A nice hack would be just to change it to more than the number of days that any user existed, this would give you all the users and their expiration dates. Example:

Search-ADAccount -AccountExpiring -TimeSpan 9999999.00:00:00 | where {$_.ObjectClass -eq 'user'} | FT Name,ObjectClass –A

Here is another way to do it:

For 2003/2008 use Quest PowerShell AD modules from http://www.quest.com/powershell/activeroles-server.aspx and use this syntax:

Get-QADUser -Name * | select givenName,sn,name,PasswordExpires

at the end you can add | Export-CSV c:\userpass_expiration.csv to export the results to file.

For 2008 R2 use this syntax:

Get-ADUser -Name * | select givenName,sn,name,PasswordExpires
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .