Check Last Password Change Date in Active Directory

Users who haven’t changed their password in months are a security risk and may not be compliant with your organization’s password policy. In this guide, I’ll show you how to check the last password change date for Active Directory users using PowerShell, and the AD Pro Toolkit.

How to Check Last Password Change in Active Directory

A users last password change date is stored in the pwdLastSet attribute. You can check this value using ADUC or PowerShell.

1. Open Active Directory users and Computers
2. Open the account properties
3. Select the Attribute Editor tab
4. Scoll down to the pwdLastSet attribute

Check Password Change Date with PowerShell

In this example, I’ll show you how check the last password change date using PowerShell.

Step 1. Open PowerShell

Step 2. Copy and run the below command.

Change -identity to the username of the account you want to check.

Get-ADUser -identity robert.allen  -properties PwdLastSet  | sort Name | ft Name,@{Name='PwdLastSet';Expression={[DateTime]::FromFileTime($_.PwdLastSet)}}

To get the last password change date for all users in Active Directory use the below command.

Get-ADUser -filter * -properties PwdLastSet  | sort Name | ft Name,@{Name='PwdLastSet';Expression={[DateTime]::FromFileTime($_.PwdLastSet)}}

AD Pro Toolkit Method

The toolkit includes an Active Directory Reporting Tool that makes it easy to run password reports for all users or specific user accounts.

Browse to Reports > Password Reports > Password Last Set Date

Download AD Pro Toolkit

Get-ADUser PwdLastSet Details

The PwdLastSet attribute is stored as an Interger8 data type, meaning it’s not in a readable format.

The PowerShell expression below is used to convert the PwdLastSet value to a readable value.

@{Name='PwdLastSet';Expression={[DateTime]::FromFileTime($_.PwdLastSet)}}

Here is a screenshot of the value of the PwdLastSet attribute before converting it.

Here is a screenshot after adding the expression to the PowerShell command.