domain account expires issue

Question

Dear experts,

when user try to change his domain account password, it shows "the user accounts has expired". when I check the account property, it shows never expire.

Thanks for your suggestion.

Answer 1

Hello @RICK-0238

The main reason why the error appears is because the Account has set some expiration date, you can check this in:

Accessing to the Domain Controller, and opened AD Users and Computers, and right clicked on the user, choose properties, and click on the Account Tab, you will see at the bottom of the Tab an item called: Account expires. Your choices are "Never" and "End of". I suspect the user account was set to expire.

Another possibility is that there is some AD replication issue for the account, for this:

first run: dsquery user -name lisalu

this will display the distinguishedName of the user.

Use that value to run the following (replace the entries in italics with the corresponding names):

repadmin /showobjmeta <DC_in_the_central_site_or_PDC> <distinguishedName_of_the_user>
and
repadmin /showobjmeta <Usual_Logon_DC_for_the_user> <distinguishedName_of_the_user>

Further than that you test the health of your AD with the next commands:
-> DCDIAG /V /C /D /E /s:yourdcname > c:\dcdiag.log
-> netdiag.exe /v > c:\netdiag.log (On each dc)
-> repadmin.exe /showrepl * /verbose /all /intersite > c:\repl.txt
-> repadmin /replsum > c:\replsum.txt
-> ADReplStatus
-> dnslint /ad /s "ip address of your dc"

Hope this helps with your query,

---

--If the reply is helpful, please Upvote and Accept as answer--

Answer 2

Hi,

Don't confuse between the password expiration and the account expiration.

I invite you to follow the link below, it can help you to fix the expiration issue of this account:

the-users-account-has-expired-on-windows-10

Please don't forget to mark helpful reply as answer