Checking Active Directory password expiration

Goal Check when an Active Directory password was changed and when it expires, including the effective password policy.

Requirements

ActiveDirectory PowerShell module
Permission to read the user object

Read the user status

Replace the placeholder with the account in your environment.

Get-ADUser -Identity "EXAMPLE.USER" -Properties PasswordLastSet,PasswordNeverExpires,PasswordExpired,msDS-UserPasswordExpiryTimeComputed |
Select-Object SamAccountName,Enabled,PasswordLastSet,PasswordNeverExpires,PasswordExpired,
@{N="PasswordExpiry";E={[datetime]::FromFileTime($_."msDS-UserPasswordExpiryTimeComputed")}}

Check effective policy

A fine-grained password policy can override the domain default.

Get-ADDefaultDomainPasswordPolicy
Get-ADUserResultantPasswordPolicy -Identity "EXAMPLE.USER"

Require a compliant change

Prefer a managed password change over setting passwords never to expire.

Set-ADUser -Identity "EXAMPLE.USER" -ChangePasswordAtLogon $true

Caution

Do not use PasswordNeverExpires as a permanent shortcut. Apply controlled password management even to service accounts.