The maxPwdAge attribute is a built-in domain-level attribute in Active Directory (AD) that controls the default maximum password age for all user accounts in a domain. The value specifies how long, in 100-nanosecond intervals, a password remains valid before the user is required to change it. It is stored on the domain object itself, not on individual user objects, and applies domain-wide unless overridden by a fine-grained password policy.
This article covers what maxPwdAge is, where it lives in the schema, and how to manage it using three approaches: Group Policy Management Console (GPMC), PowerShell, and ADManager Plus.
| LDAP display name | maxPwdAge |
| CN | Max-Pwd-Age |
| Syntax | Interval (Large Integer, stored as a negative value in 100-nanosecond intervals; 0 is stored as the minimum Int64 to disable expiration) |
| OM-Syntax | 65 |
| Attribute ID (OID) | 1.2.840.113556.1.4.74 |
| System ID GUID | bf9679bb-0de6-11d0-a285-00aa003049e2 |
| Single- or multi-valued | Single-valued |
| Indexed | No |
| In Global Catalog | No |
| Replicated | Yes, to all domain controllers in the domain |
| Visible in default ADUC UI | No, managed via Group Policy or Active Directory Service Interfaces Editor (ADSI Edit) on the domain object |
| Applies to | Windows 2000 Server and later (Domain-Policy, Sam-Domain, Sam-Domain-Base classes) |
| Source schema | Microsoft core AD schema |
| Microsoft reference | Win32 ADSchema ยท Set-ADDefaultDomainPasswordPolicy |
Note: The value of maxPwdAge is stored as a negative Int64 (large integer) in the directory and expressed in 100-nanosecond intervals. A value of zero disables password expiration for the domain. PowerShell cmdlets and GPMC display the value in days, which is the expected input format for most management workflows. Reading the raw attribute value via ADSI Edit or LDAP tools will return a large negative number; this is correct behavior.
maxPwdAge was introduced as part of the core Microsoft AD schema to enforce periodic password rotation across a domain. Every domain that runs Active Directory Domain Services (AD DS) has this attribute set on the domain object. When the attribute is configured, AD calculates each user's password expiration date by adding the maxPwdAge value to the pwdLastSet timestamp on the user's account.
Common uses of this attribute include:
maxPwdAge is the right tool when a single expiration rule covers the entire domain. It requires no additional AD objects and applies automatically to every account not targeted by a Password Settings Object (PSO).
Fine-grained password policies are the right tool when different populations need different rules. Each fine-grained password policy is stored as a PSO under CN=Password Settings Container,CN=System,DC=.... The PSO contains its own msDS-MaximumPasswordAge value and is linked to a security group or individual account. Common scenarios include shorter cycles for privileged accounts (30-60 days), longer windows for service accounts (180-365 days), or stricter expiration for users with access to regulated systems.
When multiple PSOs apply to the same user, AD resolves the conflict using msDS-PasswordSettingsPrecedence, through which the PSO with the lowest precedence value wins. A PSO applied directly to a user always beats a group-linked PSO regardless of precedence.
maxPwdAge remains the fallback for any account not covered by a PSO. To achieve consistent password expiration across the domain while accommodating exceptions, set maxPwdAge to the baseline for the majority, then use PSOs to tighten or relax it for specific groups. To confirm which policy applies to a given account, run:
powershellGet-ADUserResultantPasswordPolicy -Identity jsmith
If no PSO applies, the cmdlet returns nothing and maxPwdAge is in effect. Fine-grained password policies require a Windows Server 2008 domain functional level or higher.
maxPwdAge is a domain-level attribute on the domain object (Sam-Domain). The standard management path is the Group Policy Management Console (GPMC), which exposes the value as the Maximum password age setting in the Default Domain Policy. ADUC itself does not surface this attribute. Direct editing via ADSI Edit is also possible but is not recommended for routine management.
After replication, domain controllers apply the updated domain password policy.
Note: Changes to password policy in the Default Domain Policy propagate to domain controllers during the next replication cycle. You can force immediate application on a DC with gpupdate /force.
The AD PowerShell module provides Get-ADDefaultDomainPasswordPolicy and Set-ADDefaultDomainPasswordPolicy as the primary cmdlets for reading and writing maxPwdAge. These cmdlets translate the raw 100-nanosecond interval value to and from a human-readable TimeSpan format. You can also read the raw attribute value via Get-ADObject if you need the underlying integer.
Get-ADDefaultDomainPasswordPolicy -Identity internal.com | Select-Object MaxPasswordAge
This cmdlet returns the MaxPasswordAge value for the specified domain as a TimeSpan object (days, hours, minutes).
To read the raw attribute value from the domain object:
Get-ADObject -SearchBase (Get-ADDomain).DistinguishedName \
-SearchScope Base -Filter * -Properties maxPwdAge |
Select-Object maxPwdAge
This returns the raw large integer value stored in the directory (a negative number expressed in 100-nanosecond intervals).
Set-ADDefaultDomainPasswordPolicy -Identity internal.com -MaxPasswordAge 90.00:00:00
This cmdlet sets the maximum password age to 90 days for the domain. The TimeSpan format is days.hours:minutes:seconds.
To disable password expiration domain-wide:
Set-ADDefaultDomainPasswordPolicy -Identity internal.com -MaxPasswordAge 0
This sets maxPwdAge to zero, which disables password expiration. AD stores this as the minimum Int64 value (-9223372036854775808).
Get-ADUserResultantPasswordPolicy -Identity jsmith
This cmdlet returns the effective password policy applied to the specified user, accounting for both domain-wide and fine-grained policies. Requires the AD module.
(Get-ADForest).Domains | ForEach-Object {
$pol = Get-ADDefaultDomainPasswordPolicy -Identity $_
[PSCustomObject]@{
Domain = $_
MaxPasswordAge = $pol.MaxPasswordAge
}
} | Export-Csv .\domain-pwd-policy-report.csv -NoTypeInformation
This cmdlet iterates over every domain in the forest, retrieves the default domain password policy, and exports MaxPasswordAge values to a CSV file.
ADManager Plus surfaces maxPwdAge through its password policy management workflows. You can view and modify the domain-wide maximum password age, report on password expiration status, and delegate password-related tasks to help desk operators without granting Domain Admin rights.
ADManager Plus provides prebuilt reports that use the domain maxPwdAge value to calculate expiration status for all users.
To allow a help desk operator to run password expiration reports and reset passwords within a defined OU, without granting Domain Admin rights, use help desk delegation:
The delegated operator can run password-related reports and reset passwords for accounts in their assigned scope.
ADManager Plus will use the domain maxPwdAge and each user's pwdLastSet value to calculate upcoming expirations and dispatch notifications automatically.
By default, maxPwdAge on the domain object is readable by all authenticated users in the domain. This is expected behavior: Any domain member can query the domain password policy, and this visibility is required for applications that need to calculate password expiration dates. The value itself does not expose sensitive credential data.
Check the DONT_EXPIRE_PASSWORD flag in each affected user's userAccountControl attribute. This flag, when set, overrides maxPwdAge for that individual account. Run Search-ADAccount -PasswordNeverExpires to list all affected accounts.
This discrepancy usually indicates that the Default Domain Policy has a blank or undefined Maximum Password Age setting. While the domain object's maxPwdAge attribute was set directly (for example, via ADSI Edit or an older management tool), GPMC reads the GPO, not the raw attribute. Use Set-ADDefaultDomainPasswordPolicy to align the domain object attribute, then confirm the value in GPMC by checking Effective Policy in the domain controller's local security policy.
Password expiration is calculated from the user's pwdLastSet value and the domain's maxPwdAge. If you change maxPwdAge, the computed expiration date for existing accounts can change immediately. For example, reducing the maximum password age can cause accounts with older passwords to expire sooner. If users still appear to have the old value, verify replication and confirm the effective password policy being applied.
This means maxPwdAge is set to zero in the directory (passwords never expire). If this is not the intended state, set the value using Set-ADDefaultDomainPasswordPolicy -MaxPasswordAge 90.00:00:00 and verify the change with Get-ADDefaultDomainPasswordPolicy.
Fine-grained password policies (PSOs) take precedence over maxPwdAge for the users and groups they are applied to. A PSO-assigned user's effective maximum password age comes from the PSO's msDS-MaximumPasswordAge attribute, not from the domain maxPwdAge. Use Get-ADUserResultantPasswordPolicy -Identity <username> to confirm which policy is actually in effect for a specific user.
ADManager Plus gives you centralized control over domain password policies, password expiration reporting, and account life cycle workflows, without requiring Domain Admin rights for every task. You can view, update, and report on maxPwdAge and related policy attributes, delegate password resets to help desk staff, and automate expiration notifications, all from a single web-based console.
The default value is 42 days, which is expressed internally as a large negative integer. This default is set when a new AD domain is provisioned. Many organizations modify it to 60, 90, or 180 days, or disable expiration entirely depending on their security requirements.
The attribute is stored on the domain object at the root of the domain naming context (for example, DC=internal,DC=com). It is not stored on individual user objects. To view it directly, open ADSI Edit, connect to the domain naming context, and open the properties of the root domain object.
No, when the DONT_EXPIRE_PASSWORD flag is set in a user's userAccountControl attribute, that individual account ignores maxPwdAge entirely. The per-account flag takes precedence over the domain policy.
Setting the value to zero disables password expiration for the entire domain. AD stores this as the minimum Int64 value. All users whose passwords would otherwise expire are no longer forced to change their passwords unless a fine-grained password policy is in effect for their accounts.
Fine-grained password policies (PSOs) take precedence over the domain maxPwdAge for any user or group they are directly or indirectly applied to. The domain maxPwdAge acts as the fallback for all accounts not covered by a PSO. Use Get-ADUserResultantPasswordPolicy to determine the effective policy for a specific account.
No, domain-level password policy attributes apply to the entire domain, not to OUs. To apply different maximum password age values to different user populations (per group or per user), create fine-grained password policies with the desired msDS-MaximumPasswordAge values and link them to the target groups or users.
No, maxPwdAge is a domain object attribute and is not synced to Microsoft Entra ID as part of standard Microsoft Entra Connect synchronization. Password expiration policies in Entra ID are configured separately through the Entra ID Password Protection and Password Policies settings in the Microsoft Entra admin center.