How to check the last password change date in Active Directory using PowerShell

Monitoring password changes is crucial for maintaining security in Active Directory (AD) environments. The Get-ADUser cmdlet provides access to password-related properties that help administrators track when users last updated their credentials. This information is vital for compliance audits, identifying accounts with outdated passwords, and generating password expiration reports. By leveraging PowerShell's capabilities with specific AD attributes, administrators can effectively monitor password hygiene across the organization.

Understanding PasswordLastSet and pwdLastSet

Active Directory stores password change information through two related but distinct characteristics:

• pwdLastSet is the actual LDAP attribute stored in Active Directory. This attribute contains a 64-bit integer representing the number of 100-nanosecond intervals since January 1, 1601 (Windows FileTime format). The value automatically updates whenever a password change occurs, whether initiated by the user, an administrator, or through a password reset process.
• PasswordLastSet is the PowerShell property exposed by the Get-ADUser cmdlet. When you query this property, PowerShell automatically converts the raw pwdLastSet value into a more readable DateTime object. This conversion simplifies working with the data in scripts and reports, eliminating the need for manual FileTime conversions.

Special cases and null values

The pwdLastSet attribute exhibits specific behaviors in certain scenarios:

• Returns null for newly created accounts that haven't received an initial password.
• Becomes null when the User must change password at the next logon option is enabled.
• Gets set to 0 (zero) to force password expiration.
• Updates to the current timestamp during any password change operation.

These special cases require careful handling in scripts to avoid errors and ensure accurate reporting.

Example use cases and scripts

Example 1: Get the password last set date for a specific user.

Retrieve the date when a specific user last changed their password to verify compliance with password policies.

This command shows the exact date and time when the specified user's password was last changed.

Example 2: Find users who haven't changed their passwords in 90 days.

Create an AD user password age script to identify users with passwords older than 90 days.

This PowerShell last password change query helps identify security risks from stale passwords.

Example 3: Check when passwords were last changed AD for enabled accounts only.

Focus security reviews on active accounts by filtering for enabled users only.

This command helps identify active accounts that may need password policy enforcement.

Supported parameters

Troubleshooting common password last set query issues

Error: PasswordLastSet property returns empty or null.

• Cause: User has never set a password or property not specified in the query.
• Solution: Include the property explicitly and handle null values:
  Copy Get-ADUser -Filter * -Properties PasswordLastSet |
Select Name,@{N='PasswordLastSet';E={if($_.PasswordLastSet){$_.PasswordLastSet}else{'Never Set'}}}

Error: Date shows a large number instead of a readable date.

• Cause: PasswordLastSet is stored in FileTime format (Int64).
• Solution: Convert to DateTime format:
  Copy Get-ADUser -Identity "user" -Properties PasswordLastSet |
Select Name,@{N='LastSet';E={[DateTime]::FromFileTime($_.PasswordLastSet)}}

Error: PowerShell password expiration report shows incorrect dates.

• Cause: Not accounting for the domain's MaxPasswordAge policy.
• Solution: Calculate expiration using domain policy:
  Copy $maxPwdAge = (Get-ADDefaultDomainPasswordPolicy).MaxPasswordAge.Days
Get-ADUser -Filter * -Properties PasswordLastSet |
Select Name,@{N='ExpiresOn';E={$_.PasswordLastSet.AddDays($maxPwdAge)}}

Error: Get-ADUser PasswordLastReset not working for fine-grained password policies.

• Cause: Fine-grained password policies (FGPP) require different calculation.
• Solution: Check for applicable Password Settings Object (PSO):
  Copy Get-ADUser -Identity "user" -Properties PasswordLastSet,msDS-ResultantPSO |
Select Name,PasswordLastSet,"msDS-ResultantPSO"

Best practices to avoid issues

• Always specify -Properties parameter: PasswordLastSet is not returned by default.
• Handle null values efficiently : Check for $null before date operations.
• Test with small datasets first: Use -ResultSetSize to limit initial results.
• Use proper date comparison: Always use DateTime objects, not strings.
• Consider service accounts: Filter out or specially handle accounts with PasswordNeverExpires.

Limitations of using PowerShell to find the password last set date

• Complex date calculations: Converting the PasswordLastSet value from FileTime format requires DateTime manipulation and can lead to errors with null values.
• No automatic age calculation: You must manually calculate password age using date arithmetic for each user.
• Limited visualization: You can't create charts or graphs showing password age distribution without additional modules.
• Null value handling: Users who never set passwords return null, requiring special handling to avoid script errors.
• Performance with large datasets: Retrieving Get-ADUse r PasswordLastSet for thousands of users can be slow without proper filtering.
• No automated alerting: You can't send automatic notifications for password expirations without scheduled tasks.

FAQs

Note: For actual password history and detailed change tracking, consider using ADManager Plus, which maintains historical data.