I'd need to get a User's password expiration date from a different Windows Domain.

I have RSAT installed on my pc and, using the right credentials, I can indeed read all the target domain data using LDAP Admin or similar tools.

This is my script, working 100% but only for local domain:

function getPasswordExpiryDateforUser($user){
    $result = get-aduser $user -Server "other.domain.server:636" –Properties "DisplayName", "msDS-UserPasswordExpiryTimeComputed" | Select-Object -Property "Displayname",@{Name="ExpiryDate";Expression={[datetime]::FromFileTime($_."msDS-UserPasswordExpiryTimeComputed")}}
    return $result


If I put another domain in the -Server parameter the error I get is:

get-aduser : Unable to contact the server. This may be because this server does not exist, it is currently down, or it does not have the Active Directory Web Services running.
At C:\tests\checkUserPasswordExpiryDate.ps1:2 char:15
+ ...   $result = get-aduser $user -Server "other.domain.server: ...
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ResourceUnavailable: (myUserName:ADUser) [Get-ADUser], ADServerDownException
    + FullyQualifiedErrorId : ActiveDirectoryServer:0,Microsoft.ActiveDirectory.Management.Commands.GetADUse

Can you suggest an easy way to obtain this result?

I can successfully ping the other domain, I can successfully see its data using tools like LDAP Admin.

  • Have you checked the possible reasons given in the error message? – Gerald Schneider Aug 22 at 8:10
  • My guess would be the -server parameter ... get-aduser does not use the LDAP protocol, so having it connected to an LDAPS port can't work. – Gerald Schneider Aug 22 at 8:12
  • @GeraldSchneider How? – Pitto Aug 22 at 13:07

You could run the command on the Active Directory server. Connections that are established using Enter-PSSession and Invoke-Command communicate via HTTP by default. However, WinRM encrypts the transferred data.

Here is a link to it.


And an example:

# Query a list of domain controllers using stored credentials (include functions above)            
# List the Domain Admin group membership for all domains            
$Servers = 'dc1.alpineskihouse.com',`
$ServerList = Split-FQDN -FQDN $Servers            
$DomCreds = Get-DomainCreds -Path C:\deploy\creds.xml            
ForEach ($Server in $ServerList) {            
    '*' * 40            
    Invoke-Command -ComputerName $Server.FQDN `
        -Credential $DomCreds[$Server.Domain] -ScriptBlock {            
        Get-ADGroupMember -Identity 'Domain Admins' |             
            Select-Object -ExpandProperty distinguishedName            

It's a common misunderstanding, but the native ActiveDirectory PowerShell module doesn't actually talk to AD using LDAP (despite properties like LDAPFilter). It's using a SOAP based HTTP protocol against Active Directory Web Services on port 9389.

So if you want to use that module's functions against a remote AD with the -Server parameter, just specify the FQDN with no port. Also make sure there are no firewalls blocking TCP 9389 and that the ADWS services is running on the target server.

Your other options are PSRemoting like in @NicoKlaus's answer or if you really want to do it via LDAP, there's always ADSI.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.