Obtaining the password expiry date with PowerShell

• Author
• Recent Posts

Wolfgang Sommergut

Wolfgang Sommergut has over 20 years of experience in IT journalism. He has also worked as a system administrator and as a tech consultant. Today he runs the German publication WindowsPro.de.

Latest posts by Wolfgang Sommergut (see all)

• Which WSUS products to select for Windows 11? - Tue, Sep 26 2023
• Activate BitLocker with manage-bde, PowerShell, or WMI - Wed, Sep 20 2023
• Join Azure Active Directory with Windows 11 - Tue, Sep 12 2023

The PowerShell ActiveDirectory module allows you to read most of the information stored in AD objects. This includes the various password settings for user accounts, such as the expiry date and the time of the last change.

PowerShell is particularly useful for AD reporting because the graphical management tools are not entirely suitable for this task. After you install the Active Directory module, you can often retrieve many crucial configurations with a few simple commands.

Password management is certainly one of an Active Directory admin’s major tasks. For instance, you can display and change the current rules for users who are allowed to sign in without a password.

Reading user objects

The password expiry date and the time of the last password change are other important values of interest to admins. If you need the user list for multiple operations, you should first store it in a variable:

$Users = Get-ADUser -filter {Enabled -eq $True -and PasswordNeverExpires -eq $False} -Properties msDS-UserPasswordExpiryTimeComputed, PasswordLastSet, CannotChangePassword

This command determines all active user objects with a password expiry date. The ‑Properties parameter allows you to read the attributes of the expiry date, the date of the last password change, and the right to set a new password.

In large directories, you can restrict the query to specific domains or OUs with the help of the ‑SearchBase parameter (read Get-ADComputer – Display computers in OU or AD group with PowerShell).

Displaying the password expiry date

If you just want to generate a list of user names with their expiry dates and the times of the last password change, you can run this command:

$Users | select Name, @{Name="ExpiryDate";Expression={[datetime]::FromFileTime($_."msDS-UserPasswordExpiryTimeComputed")}}, PasswordLastSet

List of user names with their expiry dates

Because the msDS-UserPasswordExpiryTimeComputed attribute doesn’t store the password expiry time in a human-readable format, the above command uses a calculated property and the function FromFileTime to convert it for output to a console.

Finding inactive accounts

Another interesting task is to find out whether particular users haven’t changed their password in a long time. Aside from the last logon date, this information could also hint to inactive accounts:

$maxPWAge = (Get-ADDefaultDomainPasswordPolicy).MaxPasswordAge.Days

This command will retrieve the default setting for the maximum age of passwords. You can then add this value to the expiry date to determine whether the result is a date in the past:

foreach($u in $Users){
     if( [datetime]::FromFileTime($u.'msDS-UserPasswordExpiryTimeComputed').addDays($maxPWAge) -lt (Get-Date)) {
         $u. DistinguishedName; $u.PasswordLastSet -replace "`n|`r","" 
     }
 }

The users listed in the result hadn’t changed their password since the expiry date. If the calculated date is far in the past, the corresponding accounts are most likely inactive.

Users who cannot change their password

However, another explanation could be that those users are not allowed to change their password. The following code reveals whether the password of such users has expired and if an administrator should take a closer look:

foreach($u in $Users){
     if($u.CannotChangePassword -eq $true -and [datetime]::FromFileTime($u."msDS-UserPasswordExpiryTimeComputed") -lt (Get-Date)) {
         $u. DistinguishedName
     }
 }

This call also examines whether the password expiry date lies in the past by comparing it to the current date returned by the Get-Date cmdlet.