AD / Password Age / Password Last Set

omnipower321
omnipower321 used Ask the Experts™
on
Hello,

I am trying to get a report of what date / time users last changed their passwords.  When I attempt to do this via VBScript using the PasswordLastChanged attribute in an LDAP object I get a response for every user object.  When I attempt to do this is PowerShell using the Quest cmdlet "get-qaduser -sizelimit 0 | select ntaccountname,passwordlastset" I get results for the majority of systems, but a few hundred do not have anything is the passwordlastset attribute.

Can anyone fill me in on why?  I would love to gather this info with the quest tool, so that I can include it in larger PowerShell scripts, but need complete information.

thank you.
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®

Author

Commented:
replace "systems" with "users" in the question.
PowerShell Developer
Top Expert 2010
Commented:
Hey,

If  the password has never been set VbScript will (depending on implementation) record it as 01/01/1601 00:00:00, Get-QADUser will leave the value blank.

If you want to test it, run:

Get-QADUser -IncludedProperties PwdLastSet | Select-Object Name, PasswordLastSet, PwdLastSet

The same syntax (include PwdLastSet) can be used to work-around your original problem if you need to record a value regardless.

Chris

Author

Commented:
Awesome, thank you!

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial