PowerShell Get-LocalUser account expiry

[j_the_geek]

I've got a script to set a localuser account expiry date (to force them to return the laptop), but out of interest I'd like to see what the current date is when the laptop comes back

 

There doesn't appear to be a "Get-LocalUser -Name account -AccountExpires" feature

[HPlum78]

No don't seem to be part of the get-localuser cmdlet.

 

Get-WmiObject -Class Win32_UserAccount -Namespace "root\cimv2" -Filter "LocalAccount='$True'"

 

The above may get somewhere close, I cannot be any more use as I do not have a Windows device to hand.

[Arthur]

I amended this script to show the AccountExpirationDate for a local user. My version is shown below.

 

Function Get-LocalUser {
   [Cmdletbinding()]
   Param(
       [Parameter(
           ValueFromPipeline = $True, 
           ValueFromPipelineByPropertyName = $True)]
       [string[]]$Computername = $Env:Computername
   )
   Begin {
       #region Helper Functions
       
       Function ConvertTo-SID {
           Param([byte[]]$BinarySID)
           (New-Object  System.Security.Principal.SecurityIdentifier($BinarySID, 0)).Value
       }

       Function Convert-UserFlag {
           Param ($UserFlag)
           $List = New-Object  System.Collections.ArrayList
           Switch ($UserFlag) {
               ($UserFlag -BOR 0x0001    ) {[void]$List.Add('SCRIPT')}
               ($UserFlag -BOR 0x0002    ) {[void]$List.Add('ACCOUNTDISABLE')}
               ($UserFlag -BOR 0x0008    ) {[void]$List.Add('HOMEDIR_REQUIRED')}
               ($UserFlag -BOR 0x0010    ) {[void]$List.Add('LOCKOUT')}
               ($UserFlag -BOR 0x0020    ) {[void]$List.Add('PASSWD_NOTREQD')}
               ($UserFlag -BOR 0x0040    ) {[void]$List.Add('PASSWD_CANT_CHANGE')}
               ($UserFlag -BOR 0x0080    ) {[void]$List.Add('ENCRYPTED_TEXT_PWD_ALLOWED')}
               ($UserFlag -BOR 0x0100    ) {[void]$List.Add('TEMP_DUPLICATE_ACCOUNT')}
               ($UserFlag -BOR 0x0200    ) {[void]$List.Add('NORMAL_ACCOUNT')}
               ($UserFlag -BOR 0x0800    ) {[void]$List.Add('INTERDOMAIN_TRUST_ACCOUNT')}
               ($UserFlag -BOR 0x1000    ) {[void]$List.Add('WORKSTATION_TRUST_ACCOUNT')}
               ($UserFlag -BOR 0x2000    ) {[void]$List.Add('SERVER_TRUST_ACCOUNT')}
               ($UserFlag -BOR 0x10000   ) {[void]$List.Add('DONT_EXPIRE_PASSWORD')}
               ($UserFlag -BOR 0x20000   ) {[void]$List.Add('MNS_LOGON_ACCOUNT')}
               ($UserFlag -BOR 0x40000   ) {[void]$List.Add('SMARTCARD_REQUIRED')}
               ($UserFlag -BOR 0x80000   ) {[void]$List.Add('TRUSTED_FOR_DELEGATION')}
               ($UserFlag -BOR 0x100000  ) {[void]$List.Add('NOT_DELEGATED')}
               ($UserFlag -BOR 0x200000  ) {[void]$List.Add('USE_DES_KEY_ONLY')}
               ($UserFlag -BOR 0x400000  ) {[void]$List.Add('DONT_REQ_PREAUTH')}
               ($UserFlag -BOR 0x800000  ) {[void]$List.Add('PASSWORD_EXPIRED')}
               ($UserFlag -BOR 0x1000000 ) {[void]$List.Add('TRUSTED_TO_AUTH_FOR_DELEGATION')}
               ($UserFlag -BOR 0x04000000) {[void]$List.Add('PARTIAL_SECRETS_ACCOUNT')}
           }
           $List -join ', '
       }
       #endregion Helper Functions
   }

   Process {
       ForEach ($Computer in $Computername) {
           $adsi = [ADSI]"WinNT://$Computername"
           $adsi.Children | Where-Object { $_.SchemaClassName -eq 'user' } | ForEach-Object {
               [PSCustomObject]@{
                   UserName              = $_.Name[0]
                   SID                   = ConvertTo-SID -BinarySID $_.ObjectSID[0]
                   AccountExpirationDate = $_.AccountExpirationDate[0]
                   BadPasswordAttempts   = $_.BadPasswordAttempts[0]
                   LastLogin             = If ($_.LastLogin[0] -is [DateTime]) {$_.LastLogin[0]} Else { 'Never logged on' }
                   MaxBadPasswords       = $_.MaxBadPasswordsAllowed[0]
                   MaxPasswordAge        = [Math]::Round($_.MaxPasswordAge[0] / 86400)
                   MinPasswordAge        = [Math]::Round($_.MinPasswordAge[0] / 86400)
                   MinPasswordLength     = $_.MinPasswordLength[0]
                   PasswordAge           = [Math]::Round($_.PasswordAge[0] / 86400)
                   UserFlags             = Convert-UserFlag -UserFlag $_.UserFlags[0]
               }
           }
       }
   }
}

[color="#FF0000"]$env:COMPUTERNAME[/color] | Get-LocalUser | Where-Object UserName -eq '[color="#FF0000"]Example[/color]'

[Norphy]

I think I must be missing something obvious here but there you go...

 

You can get the expiry date of a local account by using a single line of PowerShell

 

get-localuser  | select Name, Enabled, AccountExpires

[HPlum78]

 

I have attached the std out from the get-localuser cmdlet, I cannot see in that list where I can select Enabled or accountExpires. is this a version thing?

 

Even when I do a select * those props are not returned.....

 

 

Have attached my $PsVersionTable for comparison

Edited November 28, 2017 by HPlum78

[Norphy]

Possibly. I'm using Windows 10 and PowerShell 5. This what I get:

 

PS C:\WINDOWS\system32> get-localuser -name "administrator" | select *


AccountExpires         :
Description            : Built-in account for administering the computer/domain
Enabled                : True
FullName               :
PasswordChangeableDate : 25/04/2017 10:58:51
PasswordExpires        :
UserMayChangePassword  : True
PasswordRequired       : True
PasswordLastSet        : 25/04/2017 10:58:51
LastLogon              : 25/04/2017 10:59:05
Name                   : Administrator
SID                    : S-1-5-21-718854812-3235948067-470550057-500
PrincipalSource        : Local
ObjectClass            : User

[HPlum78]

Ah that's the answer right there, mystery solved Scooby.