Powershell - Expired Passwords

[karldenton]

Hi

 

We use AD admin centre to set staff Passwords to expire every 90 days

 

However if I run net user username /domain in powershell it says it expires in 2023

 

I have tried a script but it still doesn't pick any up as AD thinks they are not expiring till 2023

 

Does anyone have a different script we can use to see if a password has expired

 

Thanks

 

 

 

[fordea]

Try using the msDS-UserPasswordExpiryTimeComputed property:

 

Get-ADUser j.bloggs -Properties msDS-UserPasswordExpiryTimeComputed |
   Select Name, @{n='PwdExpiry';e={[Datetime]::FromFileTime($_.'msDS-UserPasswordExpiryTimeComputed')}}

[karldenton]

Amazing, that picks up the correct date.

Is there a way to list all AD accounts that have expiry date of before today?

Thanks

[fordea]

Sure you can add a Where-Object filter to check this and also change Get-ADUser to fetch multiple (or all) of your AD users. To check every AD User you could do:

 

Get-ADUser -Filter * -Properties msDS-UserPasswordExpiryTimeComputed |
   Select Name, @{n='PwdExpiry';e={[Datetime]::FromFileTime($_.'msDS-UserPasswordExpiryTimeComputed')}} |
   Where {[Datetime]::Now -gt $_.PwdExpiry}

 

I'd recommend filtering Get-ADUser first to remove service accounts and the like if you only intend to check staff/pupil accounts.

[karldenton]

Thanks for that works a treat