For an AD user account whose password is subject to expiration, the password expiration time is calculated using the user's pwdLastSet value and the applicable maximum password age (maxPwdAge). AD does not store the calculated expiration date as a persistent attribute. Instead, the domain controller calculates and exposes the expiration time through the constructed attribute msDS-UserPasswordExpiryTimeComputed when queried.
With ADManager Plus, administrators can not only find password expiration dates but also manage AD password policies to help ensure users comply with organizational password requirements.
This article covers the various ways in which you can retrieve the password expiration date including PowerShell, ADUC, and ADManager Plus.
Run the following command:
$user = Get-ADUser -Identity "jsmith" -Properties msDS-UserPasswordExpiryTimeComputed
[datetime]::FromFileTime($user.'msDS-UserPasswordExpiryTimeComputed')
This retrieves the computed password expiration timestamp for jsmith and converts it into a human-readable date and time.
To display name, username, and expiration together:
Get-ADUser -Identity jsmith -Properties msDS-UserPasswordExpiryTimeComputed |
Select-Object Name, SamAccountName,
@{Name='PasswordExpires'; Expression={
$exp = $_.'msDS-UserPasswordExpiryTimeComputed'
if ($exp -eq 9223372036854775807) { 'Never' }
else { [datetime]::FromFileTime($exp) }
}}
Outputs name, sAMAccountName, and expiration date. Accounts with password never expires return Never.
Get-ADUser -Filter {Enabled -eq $true} -Properties msDS-UserPasswordExpiryTimeComputed |
Select-Object Name, SamAccountName, UserPrincipalName,
@{Name='PasswordExpires'; Expression={
$exp = $_.'msDS-UserPasswordExpiryTimeComputed'
if ($exp -eq 9223372036854775807) { 'Never' }
else { [datetime]::FromFileTime($exp) }
}}
Returns all enabled accounts with display name, sAMAccountName, UPN, and computed expiration date.
Get-ADUser -Filter {Enabled -eq $true} -Properties msDS-UserPasswordExpiryTimeComputed |
Select-Object Name, SamAccountName, UserPrincipalName,
@{Name='PasswordExpires'; Expression={
$exp = $_.'msDS-UserPasswordExpiryTimeComputed'
if ($exp -eq 9223372036854775807) { 'Never' }
else { [datetime]::FromFileTime($exp) }
}} |
Export-Csv -Path 'C:\Reports\PasswordExpiration.csv' -NoTypeInformation
Writes a CSV to C:\Reports\PasswordExpiration.csv with one row per enabled user.
Native AD tools can retrieve password expiration dates, but they have several limitations when it comes to day-to-day reporting and administration.
ADManager Plus fetches password expiration date through a prebuilt report that requires no scripting. The report reads msDS-UserPasswordExpiryTimeComputed from the domain controller and presents results in a filterable, sortable table exportable in multiple formats. You can schedule this and other reports in ADManager Plus to run periodically.
Managing user passwords and tracking password status across AD can be time-consuming with PowerShell scripts and other native methods. ADManager Plus provides prebuilt reports and password management capabilities that eliminate the need for scripting for common password-related tasks. Using ADManager Plus, you can:
Run net user <username> /domain from Command Prompt, or use PowerShell's Get-ADUser <username> -Properties msDS-UserPasswordExpiryTimeComputed and convert the value with [datetime]::FromFileTime(). For local (non-domain) accounts, net user <username> without /domain shows the same information. Alternatively, you can also find the password expiration date of AD users using ADManager plus.
The built-in command is net user <username> /domain, which returns the Password expires field directly in Command Prompt without needing any scripting. To get the same information on bulk users, you can follow the steps mentioned here.
Use Get-ADUser <username> -Properties msDS-UserPasswordExpiryTimeComputed, it returns True or False directly. For complete step-by-step instructions, refer to the following webpage: How to get password expiration date
Windows doesn't natively send password expiry notifications to users. Traditionally, administrators have to create and schedule custom PowerShell scripts that query msDS-UserPasswordExpiryTimeComputed,identify accounts nearing password expiration, and send email alerts.
ADManager Plus simplifies this process with built-in password expiration notifications. Instead of maintaining custom scripts, administrators can configure automated email alerts, define notification schedules and thresholds, and notify users before their passwords expire. This helps reduce administrative effort and minimizes the risk of users being locked out due to expired passwords.
You can pipe the results of Get-ADUser to Export-Csv to create a CSV file containing each user's name, username, UPN, and password expiration date. This is useful for creating a report that can be shared or reviewed offline.
For example, to find users whose passwords expire within 14 days:
Set a date threshold using (Get-Date).AddDays(14) and filter the results based on the PasswordExpires value. This returns enabled users whose passwords are due to expire within the next 14 days while excluding accounts whose passwords are set to never expire.
Alternatively, ADManager Plus provides password expiration reports that help administrators identify users whose passwords are about to expire without having to run PowerShell queries manually.
Use the -SearchBase parameter with Get-ADUser to limit the query to a specific organizational unit. For example, -SearchBase 'OU=Sales,DC=contoso,DC=com' returns password expiration dates for enabled users in the Sales OU.
To know how to retrieve password expiration details for a single user or all users using PowerShell, see how to check Active Directory password expiration using PowerShell.
The password has expired but the account remains enabled. AD does not automatically disable accounts when passwords expire; it only blocks interactive logons requiring password authentication. Service accounts and Kerberos sessions not yet expired may still function after the expiration date.