KBY Technologies Logo
Active Directory · Windows PowerShell 5.1

AD accounts flagged "password not required"

Which user accounts have the PASSWD_NOTREQD flag set, so the domain password policy doesn't force them to have a password?

Script

#Requires -Modules ActiveDirectory
# User accounts with PASSWD_NOTREQD set in userAccountControl (0x0020). Read-only.

$filter = '(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=32))'

Get-ADUser -LDAPFilter $filter -Properties PasswordNotRequired, PasswordLastSet, LastLogonDate |
    Sort-Object @{ Expression = 'Enabled'; Descending = $true }, Name |
    Select-Object Name, SamAccountName, Enabled, PasswordNotRequired, PasswordLastSet, LastLogonDate, DistinguishedName

Checked automatically against Microsoft's published cmdlet reference. KBY hasn't run it in your tenant; run it in a test environment first.

Where to run it

A domain-joined machine with the Active Directory module (RSAT) installed.

Reading the output

  • Finds user objects with PASSWD_NOTREQD (0x0020) set in userAccountControl. Disabled accounts are included and marked Enabled = False, because enabling one later would bring the flag back into play.
  • Microsoft notes that interdomain trust accounts have PASSWD_NOTREQD set by default, so if one appears here (a name ending in $) it is expected. Any other account with the flag deserves a look.
  • The flag allows an empty password; it doesn't mean the password is empty. This script can't tell whether one is set.

Sources

The Microsoft reference page for every cmdlet the script calls, plus the API and product pages behind each permission and caveat.

Get-ADUser (ActiveDirectory)Use the UserAccountControl flags to manipulate user account propertiesabout_ActiveDirectory_Filter (Filter and LDAPFilter, bitwise AND matching rule)Search filter syntax (LDAP_MATCHING_RULE_BIT_AND and presence filters)about_ActiveDirectory_ObjectModel (LastLogonDate, PasswordLastSet and the account flag properties)Sort-Object (Microsoft.PowerShell.Utility)Select-Object (Microsoft.PowerShell.Utility)
All scripts