Solved

Powershell: Search for Users with "PasswordNeverExpires"

Posted on 2013-01-23
9
943 Views
Last Modified: 2013-04-16
Could someone please help - I need a Powershell script to search users in AD with password set to never expire.

Both our DC's are running Server 2003 - and Active Directory Web Services isn't running so Get-ADUser cmdlet won't work.

I would prefer not to use 3rd party cmdlets either, unless I have to.

Thanks,

A.
0
Comment
Question by:Angeal
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 3
  • 2
  • +1
9 Comments
 
LVL 18

Expert Comment

by:Sarang Tinguria
ID: 38811041
Chris has a great GUI tool You may install this on any member Machine and use via any admin/non-admin account

Cjwdev | AD Info - Active Directory Reporting www.cjwdev.co.uk/Software/ADReportingTool/Info.html
0
 
LVL 40

Assisted Solution

by:Subsun
Subsun earned 400 total points
ID: 38811783
If you are using quest ad cmdlets, then it's a single line command..
http://www.quest.com/powershell/activeroles-server.aspx
Get-QADUser -PasswordNeverExpires | Export-Csv C:\report.csv -NoTypeInformation

Open in new window

Else you can use this script to export the users accounts which has password set to never expire...
$domain = [ADSI]"LDAP://DC=test,DC=com"
$Ad = new-object directoryservices.directorysearcher
$Ad.searchroot = $domain
$Ad.filter = "(&(objectCategory=User)(userAccountControl:1.2.840.113556.1.4.803:=65536))"
$Users = $Ad.findall()
$Users | % {New-Object PSObject -Property @{
Name = $($_.Properties.name)
sn = $($_.Properties.sn)
givenname = $($_.Properties.givenname)
mail = $($_.Properties.mail)
samaccountname = $($_.Properties.samaccountname)
displayname = $($_.Properties.displayname)
 }
} | Export-Csv C:\report.csv -NoTypeInformation

Open in new window

0
 

Author Comment

by:Angeal
ID: 38812932
Hi Subsun,

Worked like a charm. I used the second script. Is there a way to filter out accounts that are disabled? (sorry, I should have asked this beforehand) So find all accounts that don't expire, and aren't disabled.

Thanks for your help! I really appreciate it.

A.
0
DevOps Toolchain Recommendations

Read this Gartner Research Note and discover how your IT organization can automate and optimize DevOps processes using a toolchain architecture.

 
LVL 5

Assisted Solution

by:coraxal
coraxal earned 100 total points
ID: 38813089
Change this line:

$Ad.filter = "(&(objectCategory=User)(userAccountControl:1.2.840.113556.1.4.803:=65536))"

Open in new window


To this:

$Ad.filter = "(&(objectCategory=User)(userAccountControl:1.2.840.113556.1.4.803:=65536)(!userAccountControl:1.2.840.113556.1.4.803:=2))"

Open in new window

0
 
LVL 40

Accepted Solution

by:
Subsun earned 400 total points
ID: 38813524
The filter provided by coraxal will give you the disabled users with password set to never expire.
If you want to get all users who are set to password never expire with the status of account, then you can use following code..
I have added a custom attribute 'Status' which will show the status of account..
[ADSI]"LDAP://DC=test,DC=com"
$Ad = new-object directoryservices.directorysearcher
$Ad.searchroot = $domain
$Ad.filter = "(&(objectCategory=User)(userAccountControl:1.2.840.113556.1.4.803:=65536))"
$Users = $Ad.findall()
$Users | % {New-Object PSObject -Property @{
Name = $($_.Properties.name)
sn = $($_.Properties.sn)
givenname = $($_.Properties.givenname)
mail = $($_.Properties.mail)
samaccountname = $($_.Properties.samaccountname)
displayname = $($_.Properties.displayname)
Status = $(IF (($($_.properties.useraccountcontrol) -band 2) -ne 2) {Write "Enabled"} Else {Write "Disabled"})
 }
} | Export-Csv C:\report.csv -NoTypeInformation

Open in new window

0
 
LVL 5

Expert Comment

by:coraxal
ID: 38813545
@Subsun...should return enabled accounts with password set to never expire, correct? Notice the "!" preceding the userAccountControl attribute.
0
 
LVL 40

Expert Comment

by:Subsun
ID: 38813725
Yea right.. I didn't notice the Not!.. :-) .. Again I didn't mean to say your filter is wrong.. Just to want to mention it will exclude the disabled users from list, so if Angeal want both disabled and enabled users with password never expire then he can use my modified code..
0
 

Author Closing Comment

by:Angeal
ID: 38813994
2 great solution to one problem - thanks guys!
0
 
LVL 5

Expert Comment

by:coraxal
ID: 38815518
@Subsun....phewww...thought I was thinking of the filter the wrong way =)  great script btw
0

Featured Post

How our DevOps Teams Maximize Uptime

Our Dev teams are like yours. They’re continually cranking out code for new features/bugs fixes, testing, deploying, responding to production monitoring events and more. It’s complex. So, we thought you’d like to see what’s working for us. Read the use case whitepaper.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Active Directory security has been a hot topic of late, and for good reason. With 90% of the world’s organization using this system to manage access to all parts of their IT infrastructure, knowing how to protect against threats and keep vulnerabil…
Recently, Microsoft released a best-practice guide for securing Active Directory. It's a whopping 300+ pages long. Those of us tasked with securing our company’s databases and systems would, ideally, have time to devote to learning the ins and outs…
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
Are you ready to implement Active Directory best practices without reading 300+ pages? You're in luck. In this webinar hosted by Skyport Systems, you gain insight into Microsoft's latest comprehensive guide, with tips on the best and easiest way…

751 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question