Tag Archive for: imaging

I'm not sure how you could manage passwords without PwdLastSet - that's a value automatically written by AD when you set your password.  Now -- they modified the security on that attribute, then the queries would fail, and basically turn up nothing.  There isn't any other way I know of to obtain that piece of information directly.  If you can't see PwdLastSet, then adding a year won't make a difference, unless you mess with the clock and figure out bit by bit when it expires, but that's messy and certainly not easy or stable.

I can't figure out why in the world someone would block security on that attribute? It's certainly not an easy thing to do.  I can think of numerous circumstances where that would break things?

Anyway.. if you have a Domain Admin or Enterprise Admin account, you could use PSexec to launch a process as the System account on the Domain Controller and basically give yourself true full control of the AD database.  But, if you have that AD level permission, it wouldn't/shouldn't block you from seeing PwdLastSet.

But, you made it sound like you *can* get it for the output? or not get it?

David F.