KBY Technologies Logo
Active Directory · Windows PowerShell 5.1

Enabled AD users whose password never expires

Which enabled user accounts in Active Directory are set so their password never expires, and how old are those passwords?

Script

#Requires -Modules ActiveDirectory
# Enabled user accounts with "password never expires" set (userAccountControl 0x10000). Read-only.

$filter = '(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=65536))'

Get-ADUser -LDAPFilter $filter -Properties PasswordNeverExpires, PasswordLastSet, LastLogonDate, Description |
    Where-Object { $_.Enabled } |
    Sort-Object PasswordLastSet |
    Select-Object Name, SamAccountName, PasswordNeverExpires, PasswordLastSet, LastLogonDate, Description, DistinguishedName

Checked automatically against Microsoft's published cmdlet reference. KBY hasn't run it in your tenant; run it in a test environment first.

Where to run it

A domain-joined machine with the Active Directory module (RSAT) installed.

Reading the output

  • Finds user objects with the DONT_EXPIRE_PASSWORD flag (0x10000) set in userAccountControl, using an LDAP bitwise filter, then keeps enabled accounts.
  • PasswordLastSet shows how long each password has been in use. Service accounts often have this flag; Microsoft's group Managed Service Accounts rotate passwords automatically instead.
  • LastLogonDate comes from lastLogonTimestamp, which is approximate.

Sources

The Microsoft reference page for every cmdlet the script calls, plus the API and product pages behind each permission and caveat.

Get-ADUser (ActiveDirectory)Use the UserAccountControl flags to manipulate user account propertiesabout_ActiveDirectory_Filter (Filter and LDAPFilter, bitwise AND matching rule)Search filter syntax (LDAP_MATCHING_RULE_BIT_AND and presence filters)about_ActiveDirectory_ObjectModel (LastLogonDate, PasswordLastSet and the account flag properties)Group Managed Service Accounts overviewWhere-Object (Microsoft.PowerShell.Core)Sort-Object (Microsoft.PowerShell.Utility)Select-Object (Microsoft.PowerShell.Utility)
All scripts