This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(0, 88%, 10%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBK%3C/text%3E%3C/svg%3E)
I have an existing user account that has been active for several years. Over the weekend something changed regarding her account and when she tried to login this morning received an account locked message. When I checked Attribute Editor the PwdLastSet Attribute was showing never instead of a date. She had a last logon time of the Friday before. I had to set the password and then she was able to change and log in (which of course populated the attribute again) but my big question is how was this possible? Should only be with a new account as far as I can find in searching. I have never experienced this condition in my 30+ years of IT work. I have seen some other posts on the topic in these forums but they were never answered.
What condition may cause this for an existing, functioning user that did have a date. I remember looking at her account a month or two ago and it had a date there which she has changed passwords since that time. No AD updates happened over the weekend. User logged in correctly on 6/23 but on 6/26 showed it was never set. We are a domain in a forest. Things should be explainable and what/who has the power to alter that field under what condition?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(172.8, 1%, 26%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERK%3C/text%3E%3C/svg%3E)
Hi,
There are scenarios when it shows as never.If the password has never been set, then pwdLastSet is 0 and PasswordLastSet is missing. If you check "User must change password at next logon" in ADUC, the system assigns 0 to pwdLastSet, and again PasswordLastSet will be missing.
If this helps , please click on Accept Answer
Checking "User must change password at next logon" does indeed set PwdLastSet to show never in the Attribute Editor. My problem is I didn't check that box. Will monitor if there is another occurrence and get a detailed print of the field values. That field was not checked when I was looking at her account before I then unlocked the account and set the password. So while that may be an explanation... it was not to my specific situation this time. While I do have AD object backups...whatever happened seems to have happened between my 6am backup and when looked at the account at 08:50. So next time I'll make sure to do another backup before fixing things to better analyze.