Powershell Active Directory Password Never Expires

Wahid, Tash 1 Reputation point
2021-03-16T15:05:30.353+00:00

Hi All,
Our Org default is to not allow password never expires. However, for operational needs, admins can change this setting per account as needed. I would like to know if anyone can direct me to a powershell script to force the bit back to false. I would want to run this on specific AD OUs and not the whole tree. The thought is we can do cleanup if an admin forgets to set this bit back after the need.

Best,
Tash

Windows Server PowerShell
Windows Server PowerShell
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.PowerShell: A family of Microsoft task automation and configuration management frameworks consisting of a command-line shell and associated scripting language.
5,453 questions
0 comments No comments
{count} votes

2 answers

Sort by: Most helpful
  1. Rich Matheisen 45,756 Reputation points
    2021-03-16T19:09:05.163+00:00

    You can try something like this (working on a DC within your organization):

    $OUs ='OU=one,DC=mydomain,DC=local','OU=two,DC=mydomain,DC=local'
    ForEach ($OU in $OUs){
            Get-ADUser -filter * -SearchScope $OU -properties Name, PasswordNeverExpires | 
                Where-Object { $_.passwordNeverExpires -eq "true" } | 
                    Where-Object {$_.enabled -eq "true"} |              # don't worry about disabled users
                        Set-ADUser -PasswordNeverExpires:$false
    }
    

    If you want to include disabled users just remove that last Where-Object.
    I don't have an AD to test this, so you might have to change the test "{$.enabled -eq 'true'}" to just "{$.enabled}".

    0 comments No comments

  2. Ian Xue (Shanghai Wicresoft Co., Ltd.) 34,111 Reputation points Microsoft Vendor
    2021-03-17T08:45:08.233+00:00

    Hi @Wahid, Tash

    Please check to see if this works for you.

    $OUs = 'OU=ou1,DC=contoso,DC=com','OU=ou22,DC=contoso,DC=com'  
    foreach($OU in $OUs){  
        Get-ADUser -Filter {PasswordNeverExpires -eq $true} -SearchBase $OU  | Set-ADUser -PasswordNeverExpires $false  
    }  
    

    Best Regards,
    Ian Xue

    ============================================

    If the Answer is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    0 comments No comments