How can I check all users in the AD for a blank password? AND Filter them....

I know how to check all user but I can't Filter them...

Here is what I have:

Get-ADUser -Filter * -SearchBase "OU=SomeOU,DC=mydomain,DC=forest,DC=local" | ForEach {
   (new-object directoryservices.directoryentry "", ("domain\" + $_.SamAccountName), "").psbase.name -ne $null
   Write-Host ""

Now I want to know how to filter the Output...


There isn't a way to do that natively.

DS Internals Test-PaswordQuality:


Install-Module -Name DSInternals -Force

There is also a free application here that uses DSInternals:


| improve this answer | |

You can find users where PasswordLastSet is null:

Get-ADUser -Filter * -SearchBase "OU=SomeOU,DC=mydomain,DC=forest,DC=local" -Properties PasswordLastSet | where { $_.PasswordLastSet -eq $null}
| improve this answer | |
  • Does this exclude users which had an initial password set when created but never changed it (e.g. because they haven't logged in yet)? – Maz Aug 14 '19 at 11:12
  • Yes, when you create a user and set an initial password, the PasswordLastSet attribute is updated, and not null. However, if the user must change his password at next logon, this attribute will be null too ! – Swisstone Aug 14 '19 at 15:40
  • Alright, thanks! – Maz Aug 14 '19 at 15:43

You could use the following the get the results with a True or False, stating that the users has a blank password or not:

Get-ADUser -Filter * -SearchBase "OU=someOU,DC=your,DC=domain" | ForEach {    $_.SamAccountName    (new-object directoryservices.directoryentry "", ("domain\" + $_.SamAccountName), "").psbase.name -ne $null    Write-Host "" }
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.