Calculate Password Age for Windows Servers using C#: C#, Windows 2000/2003/2008 Server, NetUserGetInfo, Password Age

by: jimbobmcgeePosted on 2009-09-08 at 04:49:34ID: 25280840

I think the policy setting for Maximum Password Age is stored in the Registry at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\maximumpasswordage.

Provided you have permissions, you can access the Registry remotely, using the RegistryKey object or WMI. The following (untested) code should manage it:

using System;
using Microsoft.Win32;
 
namespace RemoteReg
{ 
	public static class Program
	{
		private static readonly string[] SUBKEYS = new string[] {
			"SYSTEM", "CurrentControlSet", "Services", "Netlogon", "Parameters"
		};
		private const string VALUE = "maximumpasswordage";
 
		static void Main(string[] args)
		{
			foreach (string server in args)
			{
				RegistryKey[] keys = new RegistryKey[SUBKEYS.Length + 1];
				try
				{
					keys[0] = RegistryKey.OpenRemoteBaseKey(RegistryHive.LocalMachine, server);
 
					int last = -1;
					for (int r = 0, len = SUBKEYS.Length; r < len; r++)
					{
						keys[r + 1] = keys[r].OpenSubKey(SUBKEYS[r]);
                        if (keys[r + 1] == null) break;
					    last = r + 1;key[r].OpenSubKey(SUBKEYS[r]);
					}
 
					if (last > -1 && last < keys.Length && keys[last] != null)
					{
						const string SET_FMT = "The maximum password age for server {0} is {1} day(s)",
									 NOT_FMT = "The maximum password age for server {0} is not set";
 
						object val = keys[last].GetValue(VALUE);								 
						if (val != null) Console.WriteLine(string.Format(SET_FMT, server, val));
						else Console.WriteLine(string.Format(NOT_FMT, server));
					}
				}
				finally
				{
					for (int r = 0, len = keys.Length; r < len; r++)
					{
						if (keys[r] != null) ((IDisposable)keys[r]).Dispose();
					}
				}
			}
		}
	}
}

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:

Select all Open in new window

by: Admin_ChevronPosted on 2009-09-08 at 04:55:16ID: 25280875

hi,

Thanx for the feedback. I am not looking for the maximum password age as set in the local policy settings. I want to query the local accounts and find out when the last time the password was reset... So I want to get an answer that account "Administrator"'s password was last reset 30 days ago (i.e. it is 30 days old)

Hope that clarifys. If not, please let me know.

Thanx

by: jimbobmcgeePosted on 2009-09-08 at 07:33:49ID: 25282241

In which case you will need to use WMI to connect to the local user account. The process is a bit different for local accounts and domain accounts. Based on what you have said, I will offer the (untested) code for local accounts:

using System;
using System.DirectoryServices;
using System.Management;
 
namespace RemoteWmi
{
    public class PasswordAge
    {
        static void Main(string[] computers)
        {
            const int SECS_IN_DAY = 86400;
            const string ROOT_WMI = @"\\{0}\root\cimv2";
            const string USER_WMI = "WinNT://{0}/{1},user";
            const string USERS_WQL = "SELECT * FROM Win32_UserAccount";
            const string OUTPUT_FMT = "{0}: {1} day(s)";
            const string NAME = "Name", AGE = "PasswordAge", LOCAL = "LocalAccount";
 
            const string ADMIN_USER = "username";
            const string ADMIN_PWD = "password";
 
            foreach (string computer in computers)
            {
                ConnectionOptions opts = new ConnectionOptions();
                opts.Username = ADMIN_USER;
                opts.Password = ADMIN_PWD;
                
                ManagementScope userScope = new ManagementScope(string.Format(ROOT_WMI, computer), opts);
                ObjectQuery userQuery = new ObjectQuery(USERS_WQL);
                ManagementObjectSearcher userSearcher = new ManagementObjectSearcher(userScope, userQuery);
                ManagementObjectCollection users = userSearcher.Get();
                
                foreach (ManagementObject user in users)
                {
                    if (Convert.ToBoolean(user[LOCAL]))
                    {
                        DirectoryEntry userEntry = new DirectoryEntry(string.Format(USER_WMI, computer, user[NAME]));
                        int days = Convert.ToInt32(userEntry.Properties[AGE][0]) / SECS_IN_DAY;
                        Console.WriteLine(string.Format(OUTPUT_FMT, user[NAME], days));
                    }
                }
            }
        }
    }
}

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:

Select all Open in new window

by: Admin_ChevronPosted on 2009-09-09 at 01:15:55ID: 25289129

Thanx.. Will give it a shot... IS there no way to use a Class or API other than WMI?

by: jimbobmcgeePosted on 2009-09-09 at 06:03:03ID: 25290754

Not that I was able to determine.

by: Admin_ChevronPosted on 2009-09-22 at 01:41:14ID: 25390670

Hi,

Apologies for my llooooon delay in updating this question... I have tried the code but just can't seem to get it working... It can't seem to find objects: ConnectionOptions, ManagementScope etc. I have checked MSDN all the correct References are referenced etc.

Any ideas? Does this work for you?

by: jimbobmcgeePosted on 2009-09-22 at 10:50:46ID: 25395549

You may need to add a reference to System.Management.dll and/or System.DirectoryServices.dll before you can use them.

by: Admin_ChevronPosted on 2009-10-22 at 01:33:04ID: 25631843

added the reference and still nothing ..

by: budhPosted on 2009-10-27 at 00:42:50ID: 25669880

I have managed to get the code to work.. to a degree... however, it seems to simply hang when trying to loop through the collection:

foreach (ManagementObject user in users)
{

Any suggestions? When debugging the error seems to be "Function evaluation timed out."

Any suggestions ?

  ManagementScope userScope = new ManagementScope(string.Format(ROOT_WMI, "SERVER_NAME"), opts);
                ObjectQuery userQuery = new ObjectQuery(USERS_WQL);
                ManagementObjectSearcher userSearcher = new ManagementObjectSearcher(userScope, userQuery);
                ManagementObjectCollection users = userSearcher.Get();
 
                foreach (ManagementObject user in users)
                {
                    if (Convert.ToBoolean(user[LOCAL]))
                    {
                        DirectoryEntry userEntry = new DirectoryEntry(string.Format(USER_WMI, "ZARFNTvSQLDEV1", user[NAME]));
                        int days = Convert.ToInt32(userEntry.Properties[AGE][0]) / SECS_IN_DAY;
                        Console.WriteLine(string.Format(OUTPUT_FMT, user[NAME], days));
                    }
                }

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:

Select all Open in new window

Question

Calculate Password Age for Windows Servers using C#

Subscribe now for full access to Experts Exchange and get

Instant Access to this Solution

C#

Windows 2000/2003/2008 Server

NetUserGetInfo

Password Age

C# Programming Language

Windows 2003 Server

Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.

See what Experts Exchange can do for you.

Got a question?

We've got the answer.

Need individual assistance?

Our experts are ready to help.

Want to learn from the best?

Read articles from industry experts.

Working on a long term project?

Store your work and research.

What Makes Experts Exchange Unique?

Trusted by the world's most respected brands.

Faithfully serving IT professionals since 1996.

Related Solutions

Free Tech Articles

Cloud Class Webinars

Join the Community

Give a Little. Get a Lot.

Answers

3 Ways to Join

The Experts

The Experts

Testimonials

Testimonials

Testimonials

Business Clients

Business Clients

In the Press

In the Press

In the Press