Quick and Easy Ways to Check Password Expiry in Active Directory (AD) – Step-by-Step Guide

Managing password expiry in Active Directory (AD) is crucial for maintaining security and preventing unexpected user lockouts. Without proper management, expired passwords can cause workflow disruptions and security risks. In this guide, we’ll walk you through simple and efficient ways to check if a password is about to expire using PowerShell or Command Prompt.

Using PowerShell to Check Password Expiration

Check Password Expiration for a Single User

1. Run the following command:

   net user [username] /domain

2. Look for the Password expires field in the output. If it states “Never,” the password is set to never expire.

or

Get-ADUser -Identity [username] -Properties msDS-UserPasswordExpiryTimeComputed | 
Select-Object -Property DisplayName, @{Name="ExpiryDate"; Expression={[datetime]::FromFileTime($_."msDS-UserPasswordExpiryTimeComputed")}}

Check Password Expiration for Multiple Users

If you need to check the expiry dates for all enabled users whose passwords are not set to never expire, use the following command::

Get-ADUser -Filter {Enabled -eq $True -and PasswordNeverExpires -eq $False} -Properties "DisplayName", "msDS-UserPasswordExpiryTimeComputed" |
Select-Object DisplayName, @{Name="ExpiryDate";Expression={[datetime]::FromFileTime($_."msDS-UserPasswordExpiryTimeComputed")}}

This command retrieves a list of users along with their password expiration dates.

Net user https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc771865(v=ws.11)