Click here to Skip to main content
15,744,817 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
Hello All,

I am trying to create a PS Script that will search AD account with the following conditions:

Account is Active/Enabled (account not disabled)
Account is expired 90 days or more
Account password is not set to never expire
Account password has expired

I want the result to return the following values:

Name/Display Name

If there is a way to specify exclude a specific OU that would be wonderful or explicitly search multiple OU's at once.

Thanks for any help in advance.

What I have tried:

Search-ADAccount -AccountInactive -TimeSpan 90 -UsersOnly -SearchBase "OU=User Accounts,DC=domain,DC=com" |
Where-Object {($_.Enabled -eq $true) -and ($_.PasswordNeverExpires -eq $False)} | Select-object Name, SamAccountName, PasswordExpired, LastLogonDate, Pwdage, PwdLastSet  | export-csv "c:\data\export.csv"

Pwdage & PwdLastSet do not retun values they return "Microsoft.ActiveDirectory.Management.ADPropertyValueCollection"
Updated 30-Aug-18 10:20am

1 solution

Try PasswordLastSet instead of PwdLastSet.

As far as I can see, there isn't a PwdAge property; you'll need to calculate it from the PasswordLastSet property.

Something like this should work:
Search-ADAccount -AccountInactive -TimeSpan 90 -UsersOnly -SearchBase "OU=User Accounts,DC=domain,DC=com" | 
Get-ADUser -properties PasswordLastSet, PasswordNeverExpires, PasswordExpired, LastLogonDate |
Where-Object {($_.Enabled -eq $true) -and ($_.PasswordNeverExpires -eq $False)} | 
Select-object Name, SamAccountName, PasswordExpired, LastLogonDate, @{ Name = 'PasswordAge';  Expression = { (New-Timespan $_.PasswordLastSet).Days }}, PasswordLastSet  | 
export-csv "c:\data\export.csv"

Active Directory: Get-ADUser Default and Extended Properties[^]

NB: The Get-ADUser call seems to be required to load certain properties.
Share this answer
KD209 10-Sep-18 13:18pm    
Hi Richard,

Thanks for the assist with this. There is no data returning for the PasswordAge or the PasswordLastSet. Is there any other method of retrieving these specific properties?
Richard Deeming 11-Sep-18 8:11am    
Is there any data in that field if you look in Active Directory Users and Computers?

It's normally blank if the password has never been set, or the "User must change password at next logon" option is ticked.
KD209 21-Sep-18 14:10pm    
Sorry for the long delay. Yes, there is data established under the PwdAge attribute.
Richard Deeming 21-Sep-18 14:12pm    
Is the "User must change password at next logon" option ticked?
KD209 21-Sep-18 14:21pm    
That option is not checked for a majority of the users in the output file. All I am trying to do is figure out who has not logged into the system in the last 90 days, and make sure that the accounts that populate are enabled and not set to expire. The password age just helps as a reference as to how long the user may have not been logging in. If you know any other ways to get this outcome I am open.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900