The accountExpires attribute sets the date and time an Active Directory user account stops allowing logon. It was part of the original Windows 2000 Server schema and lives on the user object. The value is stored as a Windows FILETIME: the number of 100-nanosecond intervals since January 1, 1601 (UTC). Two special values, 0 and 9223372036854775807, both indicate the account never expires.

This page is a reference for the attribute itself: what it stores and where it came from, its exact schema definition, the values it can hold, and how it fits into account-expiration management.

accountExpires at a glance

Note: Two different stored values both mean never expires. A new account starts at 9223372036854775807 (the maximum 64-bit signed integer); an account that was given an expiration date and later set back to never becomes 0. Also notethe day boundary: In ADUC, the end of a date keeps the account usable through that whole day, because the stored FILETIME is midnight at the start of the following day. PowerShell stores exactly the date and time you pass, which is a frequent source of off-by-one errors.

What accountExpires is used for

Account expiration exists to put a hard end date on access without requiring anyone to remember to remove it. When the date passes, Active Directory stops the account from authenticating. The account object itself is not deleted and its userAccountControl disabled flag is not changed; logon simply fails from the expiration time onward.

Common real-world uses include:

• Contractors and temporary staff: Set access to end automatically when a contract or assignment finishes.
• Interns and seasonal workers: Provision accounts that lapse at the end of a program or season with no manual cleanup.
• Vendor and third-party access: Grant time-boxed access windows that close on their own.
• Compliance and least privilege: Enforce defined access periods and reduce the number of stale, still-enabled accounts.

Use accountExpires when access has a known end date. For an indefinite block, disable the account with the userAccountControl disabled flag instead; expiration and disabling are separate controls and behave differently.

How to manage the accountExpires attribute

You can read and change accountExpires with the same tools you already use to administer Active Directory; the right one depends on scale and who needs to do it. Active Directory Users and Computers (ADUC) exposes the value through the Account expires control on a user's Account tab, while PowerShell manages it through the Set-ADAccountExpiration cmdlet and related commands.

However, native tools have limitations: ADUC works one object at a time and cannot report on or schedule expirations, and PowerShell requires advanced scripting knowledge. For a script-free approach, ADManager Plus enables you to you set, bulk-update, standardize (through user creation and modification templates), report on, and delegate accountExpires from a single console.

View the complete guide on how to set AD account expiration date, covering each method.

Security and access considerations

This attribute uses standard default ACLs (schema default security descriptor O:BAG:BAD:S:). It is not confidential, so it is readable like other general account properties, and write access follows the normal Active Directory delegation model (Account Operators, delegated help desk roles, or explicit ACEs). Its search flags mark it to be preserved on deletion, so the value survives on the tombstone if an account is deleted.

Treat expiration as an access-window control, not a security lock. An expired account still exists and can be re-enabled by clearing the date, so for a definitive block, disable the account. Extend the schema with a custom attribute only if you need to track expiration semantics that accountExpires cannot express.

Related attributes

• userAccountControl: Controls account settings, including whether the account is disabled. Disabling is a separate, indefinite control, distinct from a dated expiration.
• lastLogonTimestamp: Records approximately when a user last authenticated. It helps identify stale accounts that are candidates for expiration or cleanup.
• pwdLastSet: Records when the password was last set and drives password expiration. It is commonly confused with account expiration, but the two are unrelated: a password can expire while the account remains valid, and vice versa.

Frequently asked questions