Re: Password Expired Query

If you are curious about finding out more about how to actually implement
the queries yourself, we have a nice sample in our book in ch 10 that takes
you through it. Ch. 10 is available as a free download via the book's
website (see link below). The samples are in .NET (as you might guess from
the book's title), but the techniques are applicable to anyone trying to
issue their own LDAP query to do this. The .NET code samples are also
available on the website.

This type of query is notoriously hard to do in script because script has
really lousy support for Windows FILETIME and long integer data types, so
much of the calculation you have to do is a complete hack fest. It is very
clean in both .NET and C. I have seen people cobble something together in
script though.

If you just want to get this done, Joe R's tool is very easy. However, if
you want to write your own thing that supports this and want to code it
yourself, our stuff may help.

Best of luck,

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
--
"Adam Simmonds (SimAda00)" <AdamSimmondsSimAda00@xxxxxxxxxxxxxxxxxxxxxxxxx>
wrote in message news:1CC949E9-A9F0-4CEC-A2EA-3181C81EA87F@xxxxxxxxxxxxxxxx
ok thanks for your time and attention
--
_________________________
Adam Simmonds
Systems Administrator


"Joe Richards [MVP]" wrote:

No.

The problem is there isn't a flag saying the account is expired, you
have to calculate an actual value to input into the LDAP query to
determine if an account or an account password is expired.

OldCmp can be used for finding expired passwords, if you want an expired
account (i.e. admin action to specify when an account is expired, not
that a password has exceeded no change policy) you can use findexpacc.

joe


--
Joe Richards Microsoft MVP Windows Server Directory Services
Author of O'Reilly Active Directory Third Edition
www.joeware.net


---O'Reilly Active Directory Third Edition now available---

http://www.joeware.net/win/ad3e.htm


Adam Simmonds (SimAda00) wrote:
i was really looking for a way of doing it in the active directory
users and
computers console, as a saved query



.

Relevant Pages

  • Re: How to set a SINGLE domain account to never lockout?
    ... but for now there is only one password policy per domain. ... Joe Kaplan-MS MVP Directory Services Programming ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ... changed in every thirty days and we recently changed account password. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Integrated Windows Authentication Timeout?
    ... long as they are all on the same account. ... The problem I see frequently is that people have duplicate SPNs on more than ... Joe Kaplan-MS MVP Directory Services Programming ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Unlock acct permissions
    ... Joe is one of the best in the world. ... How do I get DSACLS to run on a specific account? ... The permissions in the security do not seem>>> to ... The correct permissions are on the security group, ...
    (microsoft.public.win2000.active_directory)
  • Re: searching what groups a user belong from AD but errorThe Kerberos subsystem encountered an error
    ... I was just about to write back Joe. ... private string BuildFilterOctetString ... Co-author of "The .NET Developer's Guide to Directory Services ... DirectoryEntry searchRoot = new DirectoryEntry( ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Unlock acct permissions
    ... It may actually be the best of the bunch but it is very old now so it is mostly about those GOOD FUNDAMENTALS that one needs and which Joe referenced. ... >>>Overall you appear to be a very "green" admin and you should buy one or more>>>books and learn this stuff before you do too much more. ... >>>Joe Richards Microsoft MVP Windows Server Directory Services ... How do I get DSACLS to run on a specific account? ...
    (microsoft.public.win2000.active_directory)