PowerShell: Get-ADUser to retrieve password last set and expiry information

PowerShell

I’ve written about Get-ADUser before here and here where we used it to create a list of all users and display their homedrive, homedirectory and scriptpath properties.

In this post we’ll look retrieving password information to find out when a user last changed their password and if it is set to never expire.

As a quick recap, to view the available options with Get-ADUser type.

help Get-ADUser

help get-aduser

Next we want to find out what the name of the properties of a user account we want to look at are called. So we will take a look at an individual user account in its entirety.

Get-ADUser -identity username -properties *

get-aduser properties

So the property names we are interested in are: PasswordLastSet and PasswordNeverExpires. So we can run the command specifying these properties only and output the results in a table.

Type: get-aduser -filter * -properties passwordlastset, passwordneverexpires |ft Name, passwordlastset, Passwordneverexpires

get-aduser properties passwordlastset passwordneverexpiresSo we can now see when a user last changed their password and if it is set to never expire.

To make things easier to find in a big environment you may want to sort the list by name.

Type: get-aduser -filter * -properties passwordlastset, passwordneverexpires | sort name | ft Name, passwordlastset, Passwordneverexpires

get-aduser properties passwordlastset passwordneverexpires sortAnd finally, lets export the list to CSV so we can work on it in Excel. In this example we substitute, format table (ft) for select-object.

Type: Get-ADUser -filter * -properties passwordlastset, passwordneverexpires | sort-object name | select-object Name, passwordlastset, passwordneverexpires | Export-csv -path c:\temp\user-password-info-20131119.csv

get-aduser properties passwordlastset passwordneverexpires csvBelow are some links to invaluable Microsoft Technet references.

Get-ADUser can be found here: http://technet.microsoft.com/en-us/library/ee617241.aspx

Where cmdlet can be found here: http://technet.microsoft.com/en-us/library/ee177028.aspx

Sort-Object cmdlet can be found here: http://technet.microsoft.com/en-us/library/ee176968.aspx

Select-Object cmdlet can be found here: http://technet.microsoft.com/en-us/library/ee176955.aspx

Export-csv cmdlet can be found here: http://technet.microsoft.com/en-us/library/ee176825.aspx

Related Posts:

1. PowerShell: Get-ADUser to retrieve logon scripts and home directories – Part 1

2. PowerShell: Get-ADUser to retrieve logon scripts and home directories – Part 2

3. PowerShell: Get-ADUser to retrieve disabled user accounts

4. PowerShell: How to use Get-ADUser to list all recently created accounts (and recently changed accounts)

5. PowerShell: How to add all users in an OU to a Security Group using Get-ADUser and Add-ADGroupMember

 

This is one of my most popular posts, so if you found it useful please share with your colleagues, like or leave a comment. Thanks, Carl.

28 thoughts on “PowerShell: Get-ADUser to retrieve password last set and expiry information”

  1. Al McNicoll

    On the subject of useful Active Directory tools, Mark Russinovich produced a set of excellent freeware utilities under the sysinternals brand that were bought in and supported by Microsoft, of which the Active Directory tools were a particular highlight. ADInsight and ADExplorer offer a useful GUI window on Active Directories, often offering more than the built-in Windows Server tools.
    http://bit.ly/1hcS3Sl

  4. Andy Nicholls

    Awesome. Thank you for this. Saved me a lot of time have to ISE a script myself!

    1. OxfordSBSguy.com

      Hi Hans, I expect so but off the top of my head I don’t know how to do it. I’ll try and look into it, but in the meantime if you find a solution let me know. I think it could be useful.

      Cheers,
      Carl

  8. Euric Dinkins

    Can you tell me how to convert the data shown in PasswordLastSet from the date to days?
    What I need to see is how many days it has been since the user last reset their password

  10. LazerTag

    Thanks for this. Is there any method to check the last X number dates the password was changed or does AD only maintain the very last time? I would like to see the last 3 or 4 times when certain users changed the password for their account.

  11. daniel

    get-aduser and passwordlastset don’t seem to exist in powershell version 3,4,5. Please let me know how can i check password last reset date and passwordneverexpires attribute. i am using search-adaccount since get-aduser is not available for me.

  12. Biyouk

    Thanks for sharing this scripts with us. Why it doesn’t work want I add a filter to the query ?

    PS C:\Users\toto> Get-ADUser -Filter {Enabled -eq “True”} -properties * | ft SamAccountName, DistinguishedName, PasswordLastSet

    Get-ADUser : Error parsing query: ‘Enabled -eq “True”’ Error Message: ‘syntax error’ at position: ’13’.
    At line:1 char:1
    + Get-ADUser -Filter {Enabled -eq “True”} -properties * | ft SamAccountName, Disti …
    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo : ParserError: (:) [Get-ADUser], ADFilterParsingException
    + FullyQualifiedErrorId : ActiveDirectoryCmdlet:Microsoft.ActiveDirectory.Management.ADFilterParsingException,Microsoft.ActiveDirectory.Manageme
    nt.Commands.GetADUser

    1. Griseld Islamaj

      You need to add $_.Enabled instead of Enabled, so it’s -Filter {$_.Enabled -eq “True”}

  13. Allen

    #Here is my Powershell script that shows soon-to-be expiring passwords set between 85 and 90 days ago. I started at this website and hacked/researched away till I came up with this final solution below. I hope it helps save some other Powerhelp newbies some time.

    import-module ActiveDirectory

    $PwdDays = (Get-Date).AddDays(-85)
    $PwdLimitDays = (Get-Date).AddDays(-91)

    Get-ADUser -filter {(passwordlastset -le $PwdDays) -and (passwordlastset -ge $PwdLimitDays) -and (Enabled -eq “True”)} -properties passwordlastset, passwordneverexpires, LastLogonDate, mail | sort-object passwordlastset, name | select-object Name, passwordlastset, passwordneverexpires, LastLogonDate, mail, @{Name=”Days Ago”;Expression={([DateTime]::Now – $_.PasswordLastSet).Days}} | Export-csv -path c:\user-password-info-$(get-date -f yyyy-MM-dd).csv

    1. Venkat

      Windows PowerShell
      Copyright (C) 2016 Microsoft Corporation. All rights reserved.

      PS C:\Users\vdulipala> import-module ActiveDirectory
      >>
      >> $PwdDays = (Get-Date).AddDays(-85)
      >> $PwdLimitDays = (Get-Date).AddDays(-91)
      >>
      >> Get-ADUser -Server inforexternals.net -filter {(passwordlastset -le $PwdDays) -and (passwordlastset -ge $PwdLimitDays
      ) -and (Enabled -eq “True”)} -properties passwordlastset, passwordneverexpires, LastLogonDate, mail | sort-object passwo
      rdlastset, name | select-object Name, passwordlastset, passwordneverexpires, LastLogonDate, mail, @{Name=”Days Ago”;Expr
      ession={([DateTime]::Now – $_.PasswordLastSet).Days}} | Export-csv -path C:\Users\vdulipala\Desktop\passinfo1.csv
      Get-ADUser : Error parsing query: ‘(passwordlastset -le $PwdDays) -and (passwordlastset -ge $PwdLimitDays) -and
      (Enabled -eq “True”)’ Error Message: ‘syntax error’ at position: ’91’.
      At line:6 char:1
      + Get-ADUser -Server inforexternals.net -filter {(passwordlastset -le $ …
      + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      + CategoryInfo : ParserError: (:) [Get-ADUser], ADFilterParsingException
      + FullyQualifiedErrorId : ActiveDirectoryCmdlet:Microsoft.ActiveDirectory.Management.ADFilterParsingException,Micr
      osoft.ActiveDirectory.Management.Commands.GetADUser

      PS C:\Users\vdulipala>

      Getting this error please correct me where I am doing wrong..

  14. Sylvain

    Hello,
    What can we do to users identified by the script that do not have the passwordlastset value, while in AD there is the value?
    Same question for the passwordneverexpires

    Thank for your help

  18. Tom Jones

    It’s great for “password last set,” but just as useful is “When does password expire?” The two don’t always coincide.

  19. Tom Jones

    And/or “Password already expired.” I find some users who, for some reason, don’t realize, “Oh, my password expired already – I guess I should have changed it 4 days ago, when it actually expired.” 🙂

  20. Kevin

    Hello,

    How can we explain “PasswordLastSet” 4/5/2000 when “whenCreated” is 10/27/2013?

    Management is asking, and I don’t have a suitable answer.

    Thanks.

  22. Mani

    Please let me know how to filter and show only active accounts and not disabled accounts.

    Thank you,
    Mani

Comments are closed.