How to get a list of AD users that are set to change password at next logon

Question

Hello,
I am trying to export a list of all users in AD including a column for "ChangePasswordAtLogon" attribute. I have tried a lot of different variations but none of them have worked. This is one of the formats that didn't work.
get-aduser -filter * -properties * | select SamAccountName, @{name='ChangePasswordAtLogon';expression={$_.ChangePasswordAtLogon -join";"}}, DistinguishedName

The value shows as blank in CLI output. And when exporting to CSV, it shows up as "Microsoft.ActiveDirectory.Management.ADPropertyValueCollection"

PasswordLastSet -eq'0' filter doesn't return the correct set of users either.

Is there a way to create a list of all users that includes this value either with PowerShell, LDIFF or any other tool?

Answer 1

Try the following:

# Import the Active Directory module
Import-Module ActiveDirectory
# Get all AD users with the necessary properties
$users = Get-ADUser -Filter * -Properties SamAccountName, ChangePasswordAtLogon, DistinguishedName
# Select the desired properties and export to CSV
$users | Select-Object SamAccountName, @{Name='ChangePasswordAtLogon';Expression={($_.ChangePasswordAtLogon -eq $true)}}, DistinguishedName | Export-Csv -Path "ADUsers.csv" -NoTypeInformation

---

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Answer 2

Some other iterations that I have tried are these. none of them produce the right result.
Get-ADUser -Filter {Changepasswordatlognon -eq $true} | Select-Object SamAccountName, DistinguishedName

Get-ADUser -filter * -properties * | Select SamAccountName,distinguishedName | where {$_.ChangePasswordAtlogon -eq $true}

get-aduser -filter * -properties * | select SamAccountName, pwdlastSet

Get-ADUser -Filter * -server localhost –Properties * | Select-Object -Property "samaccountname",@{Name="pwdLastSet";Expression={[datetime]::FromFileTime($_."pwdLastSet")}},@{Name="ExpiryDate";Expression={[datetime]::FromFileTime($_."msDS-UserPasswordExpiryTimeComputed")}}

Answer 3

Have a look at this: https://4sysops.com/archives/find-ad-accounts-with-changepasswordatlogon-set-and-enforce-password-change-with-powershell/

If you're only interested users with that particular value set, you'd do better by using a -Filter parameter.

Watch out for the interaction with other properties. E.g., can the user change its password? Has a password ever been set on this account?