Powershell - Find Expired AD Accounts That Are Enabled

[FN-GM]

Hello,

 

It must be the lack of sleep, but I am struggling to find what I am looking for! I am looking for a Powershell command to list AD accounts that are both

 

1. Enabled
   
2. Beyond the account expiry date (note not the password expiry)
   

 

Can anyone assist plase?

 

Thanks

 

[jthompson]

Get-ADUser -Filter {Enabled -eq $true} -properties AccountExpirationDate | Where-Object{$_.AccountExpirationDate -lt (Get-Date) -and $_.AccountExpirationDate -ne $null} | select-object SamAccountName, AccountExpirationDate

 

N.b. that might be totally suboptimal, but I believe it will work.

Edited April 17, 2023 by jthompson

[FN-GM]

Get-ADUser -Filter {Enabled -eq $true} -properties AccountExpirationDate | Where-Object{$_.AccountExpirationDate -lt (Get-Date) -and $_.AccountExpirationDate -ne $null} | select-object SamAccountName, AccountExpirationDate

 

N.b. that might be totally suboptimal, but I believe it will work.

 

Thanks to a server failure I ran out of time to check properly. But I quickly ran this and it does the trick. Thanks very much!

[FN-GM]

@jthompson thanks for this. It works a treat!

[ericmarcus]

This works for me, thanks!