Solved

Turn off Password never expires on local administrator account

Posted on 2014-10-26
3
2,823 Views
Last Modified: 2014-11-03
Hello Experts,

we have some servers where the Password Never Expires flag is checked , and I am trying to find out a scripting way to uncheck these option so that password expires on the Local administrator account.

EE
There are -bor 0x10000 (https://social.technet.microsoft.com/Forums/en-US/e4e96a5e-3b28-4673-8c61-d4abdf8f2426/win-7-setting-the-option-password-never-expires-for-a-specific-local-user?forum=winserverpowershell) which turn this option ON.

But , what is need is exact opposite. I want to turn off the option so that , the password gets expired.

Thanks,

-Prashant Girennavar.
0
Comment
Question by:Prashant Girennavar
3 Comments
 
LVL 3

Expert Comment

by:Sandeep Khanagwal
ID: 40405847
Below Solution provided by one of our EE member Mike Kline. It will help you .

You can also use adfind and admod from Joe richards

http://www.joeware.net/freetools/tools/adfind/index.htm

http://www.joeware.net/freetools/tools/admod/

adfind -default -bit -f "&(objectcategory=person)(objectclass=user)(useraccountcontrol:AND:=65536)" useraccountcontrol -adcsv | admod -sc uacclear:dont_expire_password -unsafe

I've included two screenshots

The first is just the adfind command not piped to admod to show you what accounts have the flag set for the password to never expire.

Note by default admod only changes 10 objects (great safety feature).  I added the -unsafe switch and it will do all the accounts.

Thanks
password-not-expire-adfind.jpg
password-not-expire-admod.jpg
0
 
LVL 10

Author Comment

by:Prashant Girennavar
ID: 40405855
Hello Sandeep,

This is not about AD account. This is about local administrator account on member servers.

Any other suggestions please.

Thanks,

-Prashant Girennavar.
0
 
LVL 16

Accepted Solution

by:
Joshua Grantom earned 500 total points
ID: 40406305
This should do it. Just create a txt file with the server names you want to disable for.

$servers = Get-Content C:\ServerList.txt | % {Invoke-Command -Session $_ -ScriptBlock {wmic path Win32_UserAccount where Name='Administrator' set PasswordExpires=true}}

Open in new window


or you can do it for all windows servers

$servers = Get-ADComputer -Filter {OperatingSystem -like "Windows Server*"} | % {Invoke-Command -Session $_ -ScriptBlock {wmic path Win32_UserAccount where Name='Administrator' set PasswordExpires=true}}

Open in new window

0

Featured Post

NAS Cloud Backup Strategies

This article explains backup scenarios when using network storage. We review the so-called “3-2-1 strategy” and summarize the methods you can use to send NAS data to the cloud

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Active Directory replication delay is the cause to many problems.  Here is a super easy script to force Active Directory replication to all sites with by using an elevated PowerShell command prompt, and a tool to verify your changes.
A brief introduction to what I consider to be the best editor for PowerShell.
Learn the basics of while and for loops in Python.  while loops are used for testing while, or until, a condition is met: The structure of a while loop is as follows:     while <condition>:         do something         repeate: The break statement m…
In this fifth video of the Xpdf series, we discuss and demonstrate the PDFdetach utility, which is able to list and, more importantly, extract attachments that are embedded in PDF files. It does this via a command line interface, making it suitable …

790 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question