How to Get AD Users Password Expiration Date

In this guide, I’ll show you how to get the password expiration date for Active Directory User Accounts.

This is very easy to do.

I will provide a few examples that go over how to get this information for a single user and how to get the expiration date for all AD users.

Check it out.

Method 1: Using Net User command to Display User Expiration Date

This first method uses the net user command that is built into windows. This command is used to add, remove and make changes to user and computer accounts.

To determine when the password will expire for a single account open the command prompt and type the following command:

Net user USERNAME /domain

In the below screenshot is an example for the user mfoster.

In addition to displaying the password expires date it also provides other useful information such as password last set, when the password can be changed, if the account is active and so on.

That is it for method 1.

RECOMMENDED: SOLARWIND ADMIN BUNDLE (FREE TOOL)

This is a bundle of 3 FREE Tools for Active Directory.

Bulk import users tool
Inactive Computer Account Removal Tool
Inactive User Account Removal Tool

Simplify administration and keep Active Directory secure with this trio of FREE tools.

Download Your FREE Copy of SolarWinds Admin Bundle

Method 2: Using PowerShell To List All Users Password Expiration Date

To query user information with PowerShell you will need to have the AD module installed. If you have the RSAT tools loaded then you are good to go.

To find the date the password was last set, run this command.

get-aduser -filter * -properties passwordlastset, passwordneverexpires |ft Name, passwordlastset, Passwordneverexpires

In the screenshot below you can see it returns all users, password last set date and if the password never expires.

To display the expiration date rather than the password last set date, use this command.

Get-ADUser -filter {Enabled -eq $True -and PasswordNeverExpires -eq $False} –Properties "DisplayName", "msDS-UserPasswordExpiryTimeComputed" |
Select-Object -Property "Displayname",@{Name="ExpiryDate";Expression={[datetime]::FromFileTime($_."msDS-UserPasswordExpiryTimeComputed")}}

Above command https://blogs.technet.microsoft.com/poshchap/2014/02/21/one-liner-get-a-list-of-ad-users-password-expiry-dates/and source:

To export any of the PowerShell results to a CSV just add | export-csv FILEPATH to the end.

I told you this was going to be easy. The PowerShell commands you can literally copy and past and they should work in your environment. The Net User command just requires you to enter in an AD user account to query.

You Might Also Like…

Find all Locked User Accounts

Posted in Active Directory Domain Servers

22 Comments

Eugene on July 20, 2019 at 6:35 am

Found your “Method two” very useful, thanks for publishing!

- Robert Allen on July 20, 2019 at 6:22 pm
  
  Awesome ❗ ❗
  
Goran on July 31, 2019 at 1:49 pm

Nice tips! 🙂

Bill G on August 29, 2019 at 11:18 am

EXCELLENT = Do you know how to filter by a date ?
say passwordlastset > today-2

- Richard Poole on March 25, 2020 at 11:50 am
  
  Add
  Sort-Object -property ExpiryDate
  
- Adam Johnson on May 14, 2020 at 3:46 pm
  
  $dayb4yesterday = (get-date).AddDays(-2)
  get-aduser -filter {passwordlastset -gt $dayb4yesterday}
  
Harvey Gee on December 10, 2019 at 3:51 pm

Is there a field like Enabled that we can use to filter out this where this isn’t set for the user that shows up “12/31/1600 7:00:00 PM”.

- Robert Allen on December 26, 2019 at 2:30 pm
  
  Yes use the below code to return just the enabled users
  
  get-aduser -filter {Enabled -eq $TRUE} -properties passwordlastset, passwordneverexpires |ft Name, passwordlastset, Passwordneverexpires
  
Michele on January 24, 2020 at 12:38 pm

Grazie!

Suellen on April 2, 2020 at 2:21 pm

Great! It was really helpfull!!

Jim on April 3, 2020 at 2:53 pm

Nice set of commands/scripts, very helpful!

- Robert Allen on April 11, 2020 at 4:30 pm
  
  Thank Jim
  
Nandha on April 23, 2020 at 11:20 am

Timely help! Many thanks.

Ron on May 4, 2020 at 6:40 pm

Method #1 is great. Thanks!!

Chandru on May 6, 2020 at 12:33 am

Hi

I need Only OU level

- Robert Allen on May 22, 2020 at 3:03 pm
  
  You can target an OU by using the -searchbase and the DN of the OU.
  
  Get-ADUser -Filter * -SearchBase "OU=Finance,OU=UserAccounts,DC=FABRIKAM,DC=COM"
  
Jaciel Diaz on July 15, 2020 at 3:35 pm

In method 2, is there a way to get the expiring users in the next seven days?

Israel De Leon on July 15, 2020 at 7:15 pm

Can you do this without using Get-ADUser?

Ryan F. on August 3, 2020 at 5:26 pm

Can you specify a specific user?

- Robert Allen on September 20, 2020 at 1:39 pm
  
  Yes. just use -identity USERNAME. Here is an example
  
  get-aduser -identity robert.allen -properties passwordlastset, passwordneverexpires | select Name, passwordlastset, Passwordneverexpires
  
- Ray on October 6, 2020 at 10:10 pm
  
  Get-ADUser Ryan
  
S Karthik on October 4, 2020 at 9:02 am

Thanks for sharing this, its helpful.
Is it possible to trim the expiration date..? Just want the date, without time. if so, can you please help with that..?

Method 1: Using Net User command to Display User Expiration Date

Method 2: Using PowerShell To List All Users Password Expiration Date

22 Comments

Leave a Comment Cancel Reply