one-liner getting accounts that are flagged "password never expires"

Posted on 2016-08-09
Last Modified: 2016-08-09
I'm trying to use Powershell to give me the user accounts of those accounts that have password set to not expire.
I have written this:
Search-ADAccount -PasswordNeverExpires -usersonly |get-aduser -Filter 'name -like "*wildcard*"'  | FT Name, ObjectClass

Open in new window

When run, this first supplies everything that has my *wildcard* in the name, I thought the first part of the script would only send the user accounts that are  set to not expire, clearly it does not.

Second, after the list of users is complete it throws an error over and over for 10-15 seconds:
Search-ADAccount : The server has returned the following error: invalid enumeration context.
At line:1 char:1
+ Search-ADAccount -PasswordNeverExpires -usersonly |get-aduser -Filter 'name -lik ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Search-ADAccount], ADException
    + FullyQualifiedErrorId : The server has returned the following error: invalid enumeration context.,Microsoft.ActiveDirectory.Management.Commands.SearchADAccount
Question by:SquigglyMonkey
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 3
  • 2
  • +1
LVL 16

Expert Comment

ID: 41748772
Get-Aduser  -properties * -filter "PasswordNeverExpires -eq 'True'" | ft Samaccountname, DisplayName,PasswordNeverExpires
LVL 85

Expert Comment

ID: 41748779
The first part will indeed only return accounts where the password is set to not expire.
The issue is that in the next pipeline step, you're querying again for all users matching the wildcard. What you need instead of Get-ADUser is a simple Where-Clause.
The other error might be caused by the first, because you're pretty much spamming AD with queries.
How many user accounts are we talking about?
Search-ADAccount -PasswordNeverExpires -UsersOnly  -ResultSetSize $Null | ? {$_.Name -like "*wildcard*"}  | FT Name, ObjectClass 

Open in new window


Author Comment

ID: 41748808
That won't work, it just gives me  all the accounts that are set to not expire. I am looking for a subset of those accounts that contain a specific set of characters.
I see, get-aduser doesn't care what is piped to it, it just looks at AD. I'll try what you sent and see what happens.
There are north of 50k users. thousands of which are legitimately non-expiring. But I ran into a few specific user names that were set to not expire, and should not be. They all contain something that I can filter on.
Thank you.
[Live Webinar] The Cloud Skills Gap

As Cloud technologies come of age, business leaders grapple with the impact it has on their team's skills and the gap associated with the use of a cloud platform.

Join experts from 451 Research and Concerto Cloud Services on July 27th where we will examine fact and fiction.

LVL 16

Expert Comment

ID: 41748820
Give me what you can filter on and I will attempt to send you the correct command.  Are all the users in the same OU?  We can target the OU if they are

Author Comment

ID: 41748889
Foxluv, thanks, "priv-" or ADM- is what the accounts start with. Unfortunately, the way AD was setup in the first place, the accounts are in multiple OU's (from  geographical dispersement of sites).

odba, Thanks that is super close, It's usable, just giving me a few extra names. I tried to change -like to -contains, but that does not work at all. I tried to add or to is since the accounts start with a couple of different things.

Thanks again.
LVL 13

Expert Comment

by:Dustin Saunders
ID: 41748899
Maybe I'm not understanding by why not add your wildcard to the filter?

Get-ADUser -Properties * -Filter {PasswordNeverExpires -eq "True" -and name -like "*wildcard*"}

Open in new window

LVL 16

Assisted Solution

FOX earned 250 total points
ID: 41748912
Get-Aduser  -properties * -filter "Samaccountname -like 'priv*'" | sort PasswordNeverExpires | ft Samaccountname, DisplayName,PasswordNeverExpires

The other one would be
Get-Aduser  -properties * -filter "Samaccountname -like 'ADM*'"| sort PasswordNeverExpires |ft Samaccountname, DisplayName,PasswordNeverExpires
LVL 85

Accepted Solution

oBdA earned 250 total points
ID: 41748944
$WildCards = @('priv-*', 'adm-*')
Search-ADAccount -PasswordNeverExpires | ? {$Name = $_.Name; $WildCards | ? {$Name -like $_}} | FT Name, ObjectClass

Open in new window


Author Closing Comment

ID: 41749016
Thank you both for helping out with this.

Featured Post

Online Training Solution

Drastically shorten your training time with WalkMe's advanced online training solution that Guides your trainees to action. Forget about retraining and skyrocket knowledge retention rates.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

For anyone that has accidentally used newSID with Server 2008 R2 (like I did) and hasn't been able to get the server running again because you were unlucky (as I was) and had no backups - I was able to get things working by doing a Registry Hive rec…
In this post we will be converting StringData saved within a text file into a hash table. This can be further used in a PowerShell script for replacing settings that are dynamic in nature from environment to environment.
This tutorial will show how to configure a single USB drive with a separate folder for each day of the week. This will allow each of the backups to be kept separate preventing the previous day’s backup from being overwritten. The USB drive must be s…
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.
Suggested Courses

615 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question