Password expiration attributes

Question

Password expiration attributes

John52180627 1

We have a script running Get-ADUser to determine expiration dates of passwords. It recently stopped working. Domain Admins running Get-ADUser and the relevant -Properties are able to obtain PasswordExpired, PasswordLastSet, and PasswordNeverExpires values but a non-admin is only able to see PasswordLastSet as existing and that is blank (the others don't acknowledge their existence).

2 answers

Your answer

Answer 1

Rich Matheisen 47,901

Run the code using "Run as administrator".

Prescott, Romeyn 1 Reputation point

2023-01-06T12:03:37.107+00:00

What we are trying to discern is "what changed"? This has been working for over a year and stopped on December 8th for no reason we can determine.
Rich Matheisen 47,901 Reputation points

2023-01-06T16:09:47.82+00:00

If it used to work and now it doesn't, I'd look for changes in the security of the AD. That might be at the OU level, or perhaps a security group level (e.g., the removal of a user from a group).

If users aren't allowed to see your password policy they won't be able to discover if a password has expired.

Answer 2

Hi. Thank you for your question and reaching out. I’d be more than happy to help you with your query.

You can try this command to get the password expiration:

Get-ADUser -filter {Enabled -eq $True -and PasswordNeverExpires -eq $False} –Properties "DisplayName", "msDS-UserPasswordExpiryTimeComputed" |
Select-Object -Property "Displayname",@{Name="ExpiryDate";Expression={[datetime]::FromFileTime($_."msDS-UserPasswordExpiryTimeComputed")}}

If the reply was helpful, please don’t forget to upvote or accept as answer, thank you.

Share via

Password expiration attributes

2 answers

Your answer