Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

Turn off Password never expires on local administrator account

Posted on 2014-10-26
3
Medium Priority
?
3,908 Views
Last Modified: 2014-11-03
Hello Experts,

we have some servers where the Password Never Expires flag is checked , and I am trying to find out a scripting way to uncheck these option so that password expires on the Local administrator account.

EE
There are -bor 0x10000 (https://social.technet.microsoft.com/Forums/en-US/e4e96a5e-3b28-4673-8c61-d4abdf8f2426/win-7-setting-the-option-password-never-expires-for-a-specific-local-user?forum=winserverpowershell) which turn this option ON.

But , what is need is exact opposite. I want to turn off the option so that , the password gets expired.

Thanks,

-Prashant Girennavar.
0
Comment
Question by:Prashant Girennavar
3 Comments
 
LVL 3

Expert Comment

by:Sandeep Khanagwal
ID: 40405847
Below Solution provided by one of our EE member Mike Kline. It will help you .

You can also use adfind and admod from Joe richards

http://www.joeware.net/freetools/tools/adfind/index.htm

http://www.joeware.net/freetools/tools/admod/

adfind -default -bit -f "&(objectcategory=person)(objectclass=user)(useraccountcontrol:AND:=65536)" useraccountcontrol -adcsv | admod -sc uacclear:dont_expire_password -unsafe

I've included two screenshots

The first is just the adfind command not piped to admod to show you what accounts have the flag set for the password to never expire.

Note by default admod only changes 10 objects (great safety feature).  I added the -unsafe switch and it will do all the accounts.

Thanks
password-not-expire-adfind.jpg
password-not-expire-admod.jpg
0
 
LVL 10

Author Comment

by:Prashant Girennavar
ID: 40405855
Hello Sandeep,

This is not about AD account. This is about local administrator account on member servers.

Any other suggestions please.

Thanks,

-Prashant Girennavar.
0
 
LVL 16

Accepted Solution

by:
Joshua Grantom earned 1500 total points
ID: 40406305
This should do it. Just create a txt file with the server names you want to disable for.

$servers = Get-Content C:\ServerList.txt | % {Invoke-Command -Session $_ -ScriptBlock {wmic path Win32_UserAccount where Name='Administrator' set PasswordExpires=true}}

Open in new window


or you can do it for all windows servers

$servers = Get-ADComputer -Filter {OperatingSystem -like "Windows Server*"} | % {Invoke-Command -Session $_ -ScriptBlock {wmic path Win32_UserAccount where Name='Administrator' set PasswordExpires=true}}

Open in new window

0

Featured Post

Free learning courses: Active Directory Deep Dive

Get a firm grasp on your IT environment when you learn Active Directory best practices with Veeam! Watch all, or choose any amount, of this three-part webinar series to improve your skills. From the basics to virtualization and backup, we got you covered.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A quick Powershell script I wrote to find old program installations and check versions of a specific file across the network.
Measuring Server's processing rate with a simple powershell command. The differences in processing rate also was recorded in different use-cases, when a server in free and busy states.
Learn the basics of while and for loops in Python.  while loops are used for testing while, or until, a condition is met: The structure of a while loop is as follows:     while <condition>:         do something         repeate: The break statement m…
The viewer will learn the basics of jQuery, including how to invoke it on a web page. Reference your jQuery libraries: (CODE) Include your new external js/jQuery file: (CODE) Write your first lines of code to setup your site for jQuery.: (CODE)
Suggested Courses

783 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question