Most Active Directory (AD) accounts should follow the domain's password expiration policy. However, some accounts require a password that never expires, like service accounts or accounts tied to legacy applications that break when a password changes. AD handles this with a per-user setting that frees the account from the domain policy; you can turn on this setting through a console, a single PowerShell command, or a management tool.

This guide shows how to set a user's password to never expire with the Set-ADUser cmdlet in PowerShell, with the Active Directory Users and Computers (ADUC) console, and with ManageEngine ADManager Plus, including how to apply the setting to many accounts at once. It also covers how the setting interacts with the domain password policy as well as the Microsoft Entra ID equivalent and the security trade-offs to weigh before turning it on, as a non-expiring password is a real risk if it isn't used deliberately.

How the PasswordNeverExpires property works

PasswordNeverExpires is a per-user flag stored in the account's userAccountControl attribute. When it is $true, AD skips this account when it enforces the domain's maximum password age, so the password never expires, regardless of the policy. When it is $false, which is the default, the account follows the domain policy like any other. Because the flag lives in the userAccountControl bitmask, it is one specific bit (value 65536) being set or cleared, which is also how an LDAP query can find these accounts.

Prerequisites

• The AD module: Install the Remote Server Administration Tools (RSAT), which includes the Set-ADUser and Get-ADUser cmdlets. The module is available by default on domain controllers.
• Required permissions: Use an account with Account Operators or Domain Admins membership, or use one with delegated permission to modify the target user accounts.
• Domain connectivity: Run PowerShell from a domain-joined computer that can communicate with a domain controller.

Method 1: Using the Set-ADUser cmdlet in PowerShell

Import the AD module into your session first and confirm it loaded:

PowerShell sets the password to never expire with a single command. The Set-ADUser cmdlet takes the account identity and the -PasswordNeverExpires parameter:

This exempts the svc-backup account from password expiration. To put the account back under the domain policy, set the same parameter to $false:

Confirm the current state by reading the PasswordNeverExpires property with Get-ADUser, which isn't returned by default and must be requested explicitly:

Setting Password never expires for multiple users

To apply the setting to several accounts, pipe a set of users from Get-ADUser into Set-ADUser. This example finds every enabled account in a service accounts OU and exempts each one:

To audit the opposite, list the accounts that already have non-expiring passwords so you can review them. An efficient way is an LDAP filter against the userAccountControl bit:

Apply bulk changes carefully. Scoping the query to a specific OU of service accounts, rather than a broad filter, keeps the exemption from spreading to regular user accounts that should follow the policy.

Method 2: Using the ADUC console

The ADUC console sets the option through a single check box, which is the quickest route for one account:

1. Open ADUC by running dsa.msc, or launch it from Server Manager > Tools.
2. Navigate to the user, right-click the account, and select Properties.
3. Open the Account tab and find the Account options list.
4. Select Password never expires. If User must change password at next logon is checked, clear it first, since the two options conflict.
5. Click Apply > OK.

The account is now exempt from the domain's password expiration policy. To reverse the change, clear the same check box so the password follows the domain policy again.

Security considerations when passwords never expire

Setting a password to never expire removes one of the controls that limits how long a compromised credential stays useful, so the setting should be the exception, not the norm. Before enabling it, consider the following:

• Limit it to accounts that truly need it: Service accounts, legacy application accounts, and hard-coded credentials are the legitimate cases. Regular user accounts should follow the domain policy.
• Compensate with MFA: Where an account can't rotate its password, MFA and conditional access reduce the risk that a leaked password alone grants access.
• Prefer managed alternatives: A group managed service account rotates its own password automatically, giving you non-breaking credentials without a static, non-expiring password.
• Audit the accounts regularly: Review the accounts with non-expiring passwords on a schedule (using the LDAP query above or a report) and remove the exemption from any accounts that no longer need it.
• Use a strong password: Since the password won't rotate, make it long and complex from the start. Complexity and history rules still apply when it's set, so keep them strict.

The domain password policy and how per-user settings override it

The domain password policy—which is set through Group Policy and covers the maximum password age, complexity, and password history—applies to every account in the domain by default. The PasswordNeverExpires flag is a per-user exception to the maximum password age part of that policy: An account with the flag set ignores the expiration rule while still being subject to the others, such as the complexity rule, when its password is set. This is why using the flag is the right tool for a genuine exception like a service account, rather than changing the domain policy itself, which would weaken expiration for everyone. The password history and reuse rules that are governed separately by the policy are worth keeping in place even on exempt accounts.

Troubleshooting common errors

1. Import-Module ActiveDirectory fails

The required RSAT component may not be installed. On Windows 10 or 11, install it using the Add-WindowsCapability command provided in the prerequisites, then import the module again. On Windows Server, install the AD Domain Services and AD Lightweight Directory Services management tools through Server Manager or Install-WindowsFeature.

2. Access is denied on Set-ADUser

The account running the command lacks rights to modify the target user. Use an account with the required AD permissions or delegated write access to the target users. Running PowerShell as a local administrator alone does not grant permission to modify AD.

3. PasswordNeverExpires is blank in Get-ADUser output

The property isn't returned by default. Add -Properties PasswordNeverExpires to the Get-ADUser command to see it.

4. PasswordNeverExpires cannot be enabled

The User must change password at next logon option conflicts with Password never expires. Clear the former in ADUC or set ChangePasswordAtLogon to $false before enabling PasswordNeverExpires.

5. Password expiration behaves differently for a synchronized user

For synchronized users, password expiration depends on the authentication method and where sign-in occurs. On-premises AD governs on-premises, pass-through, and AD Federation Services authentication, while Entra ID applies a separate expiration policy to password-hash-synchronized cloud sign-ins. Check the policies in both environments when troubleshooting.

FAQ