asked on 9/9/2013

Find Expired User Passwords on Server 2003 R2 Domain

Hello,

I am in need of help finding users accounts who's password is or will be expiring. Many of my users are remote (mobile devices) and do not log into a workstation on the domain and do not get a indication their password will be expiring. My domain controller is a Windows Server 2003 R2 SP2 install. I have experience with Group Policy, but little with Power Shell and scripts.

Thank you for your time in advance.

Windows Server 2003 Active Directory

Last Comment

hmedme

9/14/2013

piattnd

9/9/2013

This link shows a vbscript that will do more than what you're looking for, so you'll want to trim it back.

Basically, the script (as it is in that example) will find users within a 14 day expiration period and generate an email to them. You may not need to notify them via email, so that part is up to you. The 14 day trigger point will be your notification that an account is within that 14 day period (that is configurable).

Let us know if you need help adjusting any of the code!

Prashant Girennavar

9/9/2013

There are few links , which explains how to use powershell to accomplish this task

http://community.spiceworks.com/scripts/show/804-powershell-function-get-pwdage

http://social.technet.microsoft.com/Forums/windowsserver/en-US/a74b6d0f-64ce-4685-a00c-63217708581b/password-age-with-ad-directory-powershell

Thanks,

-Prashant Girennavar.

ASKER CERTIFIED SOLUTION

jmanishbabu

9/9/2013

THIS SOLUTION IS ONLY AVAILABLE TO MEMBERS.

View this solution by signing up for a free trial.

Members can start a 7-Day free trial and enjoy unlimited access to the platform.

See Pricing Options

Start Free Trial

w_richard

9/9/2013

A same thread to your query

https://www.experts-exchange.com/questions/28210118/Password-Resetting-Whilst-Logged-In.html
Cheers..!!

hmedme

9/12/2013

ASKER

Thanks for all the responses. I will get back to this thread with results ASAP.

Thanks again.

hmedme

9/14/2013

ASKER

Ok, I decided on giving Quest ActiveRoles Management Shell as shot as has other commands I can use. I tried running the following but it returns no results.

Get-QADUser -AccountExpiresBefore "December 31, 2013"
Get-QADUser -AccountExpiresBefore "September 14, 2014"

The following command does return results:

Get-QADUser -CreatedAfter "January 1, 2009"

Thanks!

hmedme

9/14/2013

ASKER

I think this nailed it:

Get-QADUser -Name * | select givenName,sn,name,PasswordExpires

Thank you all for your help. Excellent range of answers and angles.