PowerShell - Get-Localuser PasswordExpires

Question

Hi Guys How do I check if the local user has "password expires" true or false? Thank you very much in advance

Answer 1

$userName = "your_username"

$user = Get-LocalUser -Name $userName

if ($user.PasswordNeverExpires) {
    Write-Host "$userName has 'Password never expires' set to true."
} else {
    Write-Host "$userName has 'Password never expires' set to false."
}

Replace "your_username" with the actual username you want to check. The PasswordNeverExpires property of the Get-LocalUser cmdlet will be True if the password never expires, and False otherwise. @Sergio Siqueira

Answer 2

Looks like you have to use WMI.

Get-CimInstance -ClassName Win32_UserAccount | Format-Table -Property Name, PasswordExpires

Answer 3

@Shashank Kumar Srivastava -- you almost had it right. There's no "PasswordNeveExpires" property -- what you meant (I think) was "PasswordExpires" (which may contain the expiration date). If there's no expiration date then there's no expiration of the password.

$userName = "your_username"

$user = Get-LocalUser -Name $userName

if ($user.PasswordExpires) {
    Write-Host "$userName has 'Password never expires' set to true."
} else {
    Write-Host "$userName has 'Password never expires' set to false."
}

Answer 4

If you're looking for a specific user property that identifies when a LOCAL account must change its password at the next login, you won't find one (https://learn.microsoft.com/en-us/windows/win32/api/iads/ne-iads-ads_user_flag_enum). WMI doesn't have one, either. Even if you use ADSI (e.g. $user = [ADSI]"WinNT://$computer/$localusername,user") and convert the value of that users' UserFlags property to a bit string and compare it to the enum in the 1st link ([convert]::ToString($user.UserFlags.Value,2)) you won't find such a thing (feel free to use $user | gm * -f to investigate). However, I think this will get you what you want:

$userName = "XXXX"

$user = Get-LocalUser -Name $userName

if ($user.PasswordExpires -AND $user.PasswordLastSet) {
    Write-Host "$userName has 'Password expires' set to true, and 'user must change p/w at next logon.' set"
}
elseif ($user.PasswordExpires) {
    Write=Host "$userName has 'Password expires' set to true"
} 
else {
    Write-Host "$userName has 'Password never expires' set to false."
}

Answer 5

Get-LocalComputer, CIM, and WMI don't seem to expose the necessary properties. Using ADSI does.

I've use the Computer Management snap-in to toggle the "User must change password . . ." and the change is seen by the code. It's also possible to change the property in the code (and commit the change) and setting the value to 1 selects the checkbox in the GUI. Setting it to 0 unchecks the box in the GUI.

$LocalComputer = "computername"
$user = "XXXX"
$user = [ADSI]"WinNT://$LocalComputer/$user,user"
if ($user.PasswordExpired -eq 1){
    write-host "$user must change password at next logon"
}

$user.passwordexpired = 1	# checks the box in the GUI
$user.commitchanges()

$user.passwordexpired = 0	# unchecks the box in the GUI
PS C:\Projects\Exercism> $user.commitchanges()