Solved

one-liner getting accounts that are flagged "password never expires"

Posted on 2016-08-09
9
29 Views
Last Modified: 2016-08-09
I'm trying to use Powershell to give me the user accounts of those accounts that have password set to not expire.
I have written this:
Search-ADAccount -PasswordNeverExpires -usersonly |get-aduser -Filter 'name -like "*wildcard*"'  | FT Name, ObjectClass

Open in new window

When run, this first supplies everything that has my *wildcard* in the name, I thought the first part of the script would only send the user accounts that are  set to not expire, clearly it does not.

Second, after the list of users is complete it throws an error over and over for 10-15 seconds:
Search-ADAccount : The server has returned the following error: invalid enumeration context.
At line:1 char:1
+ Search-ADAccount -PasswordNeverExpires -usersonly |get-aduser -Filter 'name -lik ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Search-ADAccount], ADException
    + FullyQualifiedErrorId : The server has returned the following error: invalid enumeration context.,Microsoft.ActiveDirectory.Management.Commands.SearchADAccount
0
Comment
Question by:SquigglyMonkey
  • 3
  • 3
  • 2
  • +1
9 Comments
 
LVL 16

Expert Comment

by:FOX
ID: 41748772
Get-Aduser  -properties * -filter "PasswordNeverExpires -eq 'True'" | ft Samaccountname, DisplayName,PasswordNeverExpires
0
 
LVL 83

Expert Comment

by:oBdA
ID: 41748779
The first part will indeed only return accounts where the password is set to not expire.
The issue is that in the next pipeline step, you're querying again for all users matching the wildcard. What you need instead of Get-ADUser is a simple Where-Clause.
The other error might be caused by the first, because you're pretty much spamming AD with queries.
How many user accounts are we talking about?
Search-ADAccount -PasswordNeverExpires -UsersOnly  -ResultSetSize $Null | ? {$_.Name -like "*wildcard*"}  | FT Name, ObjectClass 

Open in new window

0
 
LVL 1

Author Comment

by:SquigglyMonkey
ID: 41748808
FOXLUV,
That won't work, it just gives me  all the accounts that are set to not expire. I am looking for a subset of those accounts that contain a specific set of characters.
odba,
I see, get-aduser doesn't care what is piped to it, it just looks at AD. I'll try what you sent and see what happens.
There are north of 50k users. thousands of which are legitimately non-expiring. But I ran into a few specific user names that were set to not expire, and should not be. They all contain something that I can filter on.
Thank you.
0
 
LVL 16

Expert Comment

by:FOX
ID: 41748820
Give me what you can filter on and I will attempt to send you the correct command.  Are all the users in the same OU?  We can target the OU if they are
0
[Webinar] Disaster Recovery and Cloud Management

Learn from Unigma and CloudBerry industry veterans which providers are best for certain use cases and how to lower cloud costs, how to grow your Managed Services practice in IaaS clouds, and how to utilize public cloud for Disaster Recovery

 
LVL 1

Author Comment

by:SquigglyMonkey
ID: 41748889
Foxluv, thanks, "priv-" or ADM- is what the accounts start with. Unfortunately, the way AD was setup in the first place, the accounts are in multiple OU's (from  geographical dispersement of sites).

odba, Thanks that is super close, It's usable, just giving me a few extra names. I tried to change -like to -contains, but that does not work at all. I tried to add or to is since the accounts start with a couple of different things.

Thanks again.
0
 
LVL 12

Expert Comment

by:Dustin Saunders
ID: 41748899
Maybe I'm not understanding by why not add your wildcard to the filter?

Get-ADUser -Properties * -Filter {PasswordNeverExpires -eq "True" -and name -like "*wildcard*"}

Open in new window

0
 
LVL 16

Assisted Solution

by:FOX
FOX earned 250 total points
ID: 41748912
Get-Aduser  -properties * -filter "Samaccountname -like 'priv*'" | sort PasswordNeverExpires | ft Samaccountname, DisplayName,PasswordNeverExpires

The other one would be
Get-Aduser  -properties * -filter "Samaccountname -like 'ADM*'"| sort PasswordNeverExpires |ft Samaccountname, DisplayName,PasswordNeverExpires
0
 
LVL 83

Accepted Solution

by:
oBdA earned 250 total points
ID: 41748944
$WildCards = @('priv-*', 'adm-*')
Search-ADAccount -PasswordNeverExpires | ? {$Name = $_.Name; $WildCards | ? {$Name -like $_}} | FT Name, ObjectClass

Open in new window

0
 
LVL 1

Author Closing Comment

by:SquigglyMonkey
ID: 41749016
Thank you both for helping out with this.
0

Featured Post

The problems with reply email signatures

Do you wish that you could place an email signature under a reply? Well, unfortunately, you can't. That great Exchange/Office 365 signature you've created will just appear at the bottom of an email chain. What a pain! Is there really no way to solve this? Well, there might be...

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Synchronize a new Active Directory domain with an existing Office 365 tenant
This article explains how to prepare an HTML email signature template file containing dynamic placeholders for users' Azure AD data. Furthermore, it explains how to use this file to remotely set up a department-wide email signature policy in Office …
This tutorial will give a an overview on how to deploy remote agents in Backup Exec 2012 to new servers. Click on the Backup Exec button in the upper left corner. From here, are global settings for the application such as connecting to a remote Back…
This tutorial will walk an individual through the steps necessary to configure their installation of BackupExec 2012 to use network shared disk space. Verify that the path to the shared storage is valid and that data can be written to that location:…

920 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now