HowTo Check when Password Expires in Active Directory
Last Updated: March 8th, 2022 by 
Hitesh J in Guides, Windows
While working on a windows environment, Password Expiration is one of the most common issues that domain users face when logging in due to password group policies.
By default, the Windows domain user account is configured to expire passwords after a specific amount of time-based on the group policy and every user will be notified 2 to 3 weeks prior to the password expiring.
If you miss this notification and don’t change your password, your account will be Locked Out.
As a System Administrator, you will need to keep track of all user accounts and their expiration dates and you will most likely need to update passwords at regular intervals for security reasons.
To prevent users from getting locked out, you should prepare a list of all user accounts along with when the password was last set and when the password will expire next.
Lucky for you, there is an easy way to find all of this information using PowerShell.
In this tutorial, we’ll show you how to check password expiration dates in Active directory with PowerShell.
Check User Password Expiration Date with Net User Command
You can display detailed information of a specific users’ Password Expiration using the following syntax:
net user USERNAME /domain
For example, to display the password expiration information of the user “hitesh” run the following command in the PowerShell:
net user hitesh /domain
Example:
The above command will display user account information such as when the password was last set, when the password expires, and so on.
If you want to filter the output from the above command and display only password expiration dates, then you can use the find command in conjunction with the net user command as shown below:
net user hitesh /domain | find «Password expires»
Example:
Check All User Password Expiration Date with PowerShell
You can also display all user password expiration dates using PowerShell.
For example, to find the Password Expiration Date of all users in your Domain, you can run the following command:
get-aduser -filter * -properties passwordlastset, passwordneverexpires |ft Name, passwordlastset, Passwordneverexpires
Example:
If you want to display the expiration date rather than the password last set date, run the following command:
Example:
Check All User Password Expiration Date with PowerShell Script
If you want to check password expiration dates in Active Directory and display password expiration dates with the number of days until the password expires, you can achieve this by creating a PowerShell script.
You can create the PowerShell script by following the below steps:
1. Open your notepad and add the following codes:
Import-Module ActiveDirectory
$MaxPwdAge = (Get-ADDefaultDomainPasswordPolicy).MaxPasswordAge.Days
$expiredDate = (Get-Date).addDays(-$MaxPwdAge)
#Set the number of days until you would like to begin notifing the users. — Do Not Modify —
#Filters for all users who’s password is within $date of expiration.
$ExpiredUsers = Get-ADUser -Filter <(PasswordLastSet -gt $expiredDate) -and (PasswordNeverExpires -eq $false) -and (Enabled -eq $true)>-Properties PasswordNeverExpires, PasswordLastSet, Mail | select samaccountname, PasswordLastSet, @
$ExpiredUsers
2. Click on the Save as option to save the file.
3. Type a name for the script as user_list.ps1.
4. Click on the Save button to save the file.
Right click on the PowerShell script and click on the Edit button as shown below:
Now, click on the Green arrow button to run the script.
You should see the following screen if it ran successfully:
Conclusion
You are now able to get an Active Directory user account password expiration date using several methods including using the command line and using Powershell!
There are also a number of tools that offer automated password expiration reminders – see this list of free Active Directory tools.
Как посмотреть когда истечёт пароль пользователя в Active Directory
Для запуска данного скрипта достаточно прав обычного пользователя в Active Directory. Метод построен на получении значения свойства атрибута msDS-UserPasswordExpiryTimeComputed , который описан в спецификации по протоколам Windows.
В результате получаем не хитрую табличку.
Обратите внимание на то, что данный атрибут не является системным (systemOnly: FALSE). Поэтому не забудьте снять галку System-Only, если соберётесь смотреть его значение через ADUC.
Net User Command – Manage User Accounts from cmd
The command Net User allow you to create, delete, enable, or disable users on the system and set passwords for the net user accounts.
Windows administrators can perform add or modifications in domain user accounts using the net user command-line tool.
You can get net user account information, enable or disable a user account, sets the home directory path, set account expiration, and so on.
Command Net User to display user account info
In this article, we will discuss how to use the net user command-line tool with examples to get user account information, domain account status, and password expiry date.
Net User Command – Syntax
net user command syntax
Parameters
Username – It specifies user account name to add or modify or display user account information
Password – Assign or change the password for the user account
/domain – Perform the operation on the domain controller
/active:
/comment – Provide descriptive comments for the user account
/expires – Specify the date to expire user account
net help – Display help for the net user command.
<Options> – Specify command-line options.
Refer to the following table to know more about options used in net user command.
| Command-line option syntax | Description |
|---|---|
| /active: | Use this option to enable or disable a user account. The default value is yes (active). |
| /comment:”<Text>” | Use this to provide comments for the user account, max 48 characters, and should be enclosed in quotation marks. |
| /countrycode:<NNN> | /countrycode option is used to set the country code for the user account to display help or error messages in their language. The default value is 0, which means the computer’s default country/region code. |
| /expires: <<<MM/DD/YYYY> | <DD/MM/YYYY> | <mmm,dd,YYYY>>| never> | Use this option to specify the date for the user account to expire. If the expiration date is not specified, it will assume never expires. |
| /fullname:”<Name>” | Specify the user’s full name instead of username. |
| /homedir:<Path> | Use this option to set the path for the user’s home directory. |
| /passwordchg: | Use this to specify if the user can change their own password. The default value is yes. |
| /passwordreq: | It specifies if the user must have a password or not. The default is yes. |
| /profilepath:[<Path>] | Use this option to sets a path for the user’s logon profile. This path points to a registry profile. |
| /scriptpath:<Path> | Use this to set a path for the user’s logon script. <Path> should be relative. |
| /times: | It specifies the times that users are allowed to use the computer. |
| /usercomment:”<Text>” | It specifies that an administrator can add or change the “User comment” for the account. |
| /workstations: | It lists as many as eight workstations from which a user can log on to the network. |
net user command options
Net User – List all User Accounts
Use the Net User command and run it on the Windows command prompt without any parameter to list all user accounts on the local user account.
Open a command prompt to run the net user command below
The above Windows net user command returns the list of all user accounts of the local computer.
net user accounts on local computer
Run the command net user on the domain controller to get a list of all users on the domain.
The output of the above command net user gets the domain username accounts.
net user domain username
You can also use the net user command-line tool to get user account information, modify a user account, and check when the password was last set.
Net User Account – Display User Account Information
Run the net user command in the command line to get user account information.
The above net user command uses the username to retrieve user details and display net user account information below
net user account details
Cool Tip: How to get-aduser in the active directory using PowerShell!
Net User Password Change for User Account
If you want to change a user password using the command line, use the net user command-line tool to set the password.
The syntax for the command net user to set a password for a user account is given below:
Let’s consider an example to reset the password for user account GaryW on the local computer, run the below command
In the above net user command, garyw is a user account id and [email protected] is a password that is used with the command to set the password for the user account on the local computer.
The output of the above command as below
net user password change
Note: Run Windows command prompt using administrator account privileges else it will display “System error 5 has occurred. Access is denied“
There is an alternative and secure way to change the user password using the net user cmd tool as below
In the command, use * after the user name and hit enter.
It will prompt you to type the password for the user: and retype the password to confirm.
While typing a password, it won’t display password text on the command line.
Cool Tip: How to get-aduser password expiration date in PowerShell!
Net User /domain – change domain user account password
Using the net user Windows command-line tool, you can set the password for the domain user account.
The syntax for the command net user to set the password for the domain user account is:
Run the following command to reset the domain user account password
In the above command, the net user command takes the user id as input, * indicates to prompt for the password. /domain specifies to perform domain account password change operation.
The output of the above net user /domain password change as below
net user /domain password change
Cool Tip: How to use the Get-AdUser cmdlet to manage Active Directory Use Account!
Net User Disable Account
If you want to disable or lock a domain account using the net user command-line tool, run the following command
The above net user command will disable the user account or lock the domain user account specified using the user name and /Active set to No in the net user /domain
Run the command net user garyw /domain to check the user active account status
Cool Tip: How to find a disabled aduser using PowerShell!
Net User to Enable Domain Account
To enable or unlock domain account using the net user command, run the below command
net user /domain command using /Active option set to Yes enables user account.
Net User User Password Policy
If you want users to restrict them to change their domain account password or allow domain account user to change their password, run the below net user command
In the above net user command, /Passwordchg option is set to No to prevent the user from changing the password.
To allow users to change the password, run the below command
Above command, /Passwordchg option is set to Yes to allow the user to change their password.
Cool Tip: How to find active directory groups I m in using PowerShell!
Net User to find user full name
You can use the net user command-line tool to find the user’s full name in the domain as below
The above command finds the full name of the user in the domain, it uses the username /domain to find the user account in the domain and pipe the result to get the full name.
How to set home directory for user?
Use the net user command-line tool to set a home directory for a new user or existing user using the homedir option as below
Set home directory for the new user
In the above command, the net user creates a new user with the name adams in the domain and set up the home directory for the user to C:\users\adams
You can set up a home directory for the existing user as below
In the above command, it set up the home directory for the existing user in the domain using the net user command and homdir option.
Cool Tip: How to unlock the ad account in the active directory using PowerShell!
Set Expiry date for User Account on Local and Domain
The expiration date for the user account has been good practice for organizations to manage security and resource management.
Using the net user command, you can easily set an expiry date for the user account on the local computer or domain user account.
If you want to set up an expiry date for user accounts on the local computer or a windows 11 user account, run the following command.
In the above command, the net user command takes the username as the input parameter and uses /expires option to set up the expiry date for the user account on the local computer.
If you want to set up an expiry date for the user account on the domain controller, run the following command.
In the above command, the net user takes the user name and uses /domain to set up an expiry date in the domain using /expires option.
Set up Login Times for User Account
Using the net user command, you can set up login times for the user account to allow them to be used within specific hours only.
Run the following command to set login times for the user account.
In the above command, the net user command takes the user name to set up login time for the account to allow login between 7 am to 4 pm on Monday-Friday only.
Net User Command Examples and FAQ
Open the Windows command prompt with Administrator privileges and run the following command to reset the password for a user account.
net user userid newpassword
The net user is a command-line tool to manage user accounts on local and domain controllers. To use the net user command, open the command prompt and type the net user command, it will list all user accounts.
Use the net user command to view the user account details on the domain. The syntax to check user account information is:
net user userid
If you run net user userid on cmd terminal, it retrieves user information that includes the property “Password expires“. Use this property to see the user account password expiry date.
To check the last login of the user on the domain using the net user command, run the command prompt and run the below command.
net user Toms /domain | Findstr «Last»
It returns the Last Login date for the user account on the domain.
To set the password never expires on the user account using the net user command in the cmd terminal, run the following command.
WMIC useraccount where Name=’username’ set PasswordExpires=FALSE
For example, to set the administrator password never expires using the net user command,
net user administrator |findstr /C:expires
Returns the output as
Account expires Never
Password expires 2/26/2023 4:10:20 PM
Run the WMIC command to set the PasswordExpires property for the administrator account to false.
WMIC useraccount where Name=’administrator’ SET PasswordExpires=FALSE
The above command line tool, set up the administrator password never set to expire.
Conclusion
I hope the above article on the net user command line tool in the Windows system helps you to understand how to manage net user accounts using the command line.
net user without any option gets all the user accounts on the computer. You can also use net users.
You can find more topics about PowerShell Active Directory commands and PowerShell basics on the ShellGeek home page.
Как узнать срок действия пароля в домене cmd
Групповой политикой установлено, что пользователь должен установить новый пароль каждые три месяца.
Когда приближается срок завершения действия текущего пароля в области уведомлений выскакивает соответствующее сообщение, но держится оно недолго.
Как узнать оставшийся срок действия пароля? Сколько еще дней (или до какой даты) действует текущий пароль?
Коллеги, всем большое спасибо за ответы.
Насколько я понял, все эти действия можно выполнить только в среде сервера.
А может ли сам пользователь проверить срок действия своего пароля с клиентской машины?