Powershell Active Directory Password Never Expires

Question

Hi All,
Our Org default is to not allow password never expires. However, for operational needs, admins can change this setting per account as needed. I would like to know if anyone can direct me to a powershell script to force the bit back to false. I would want to run this on specific AD OUs and not the whole tree. The thought is we can do cleanup if an admin forgets to set this bit back after the need.

Best,
Tash

Answer 1

You can try something like this (working on a DC within your organization):

$OUs ='OU=one,DC=mydomain,DC=local','OU=two,DC=mydomain,DC=local'
ForEach ($OU in $OUs){
        Get-ADUser -filter * -SearchScope $OU -properties Name, PasswordNeverExpires | 
            Where-Object { $_.passwordNeverExpires -eq "true" } | 
                Where-Object {$_.enabled -eq "true"} |              # don't worry about disabled users
                    Set-ADUser -PasswordNeverExpires:$false
}

If you want to include disabled users just remove that last Where-Object.
I don't have an AD to test this, so you might have to change the test "{$.enabled -eq 'true'}" to just "{$.enabled}".

Answer 2

Hi @Wahid, Tash

Please check to see if this works for you.

$OUs = 'OU=ou1,DC=contoso,DC=com','OU=ou22,DC=contoso,DC=com'  
foreach($OU in $OUs){  
    Get-ADUser -Filter {PasswordNeverExpires -eq $true} -SearchBase $OU  | Set-ADUser -PasswordNeverExpires $false  
}  

Best Regards,
Ian Xue

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.