Re: Forcing password change with PwdLastSet=0 doesn't work

Thanks, I think that's probably it. Most of the accounts are set never
to expire.
--



Joseph T Corey wrote:

Yes, if the "Password never expires" flag is set within the
userAccountControl bitmask of an account, a value of 0 in pwdLastSet
won't do anything. You aren't getting an error because ADSI will
"allow" you to manually set the value. If you give this a shot in
ADU&C, you'll notice that both "User must change password at next
logon" and "Password never expires" can never be set at the same time
without being greeted by an error message. The reason is that
pwdLetSet essentially expires that password - but you've explicitly
(either intentionally or unintentionally) told AD that the user
cannot have an expired password. Take a look at the following to
programmatically find out if this is the case (you can always just
look at the properties of an object as well).


http://www.microsoft.com/technet/scriptcenter/resources/qanda/oct06/hey1031.mspx
http://support.microsoft.com/kb/305144
http://msdn.microsoft.com/en-us/library/aa772300.aspx
.

Relevant Pages

  • Re: Error when putting AD user attribites to Excel
    ... AccountExpirationDate is a property method. ... This property method returns the date/time when the account expires (the ... On Error GoTo 0 ... sheet with all accounts with the experation dates in it. ...
    (microsoft.public.scripting.vbscript)
  • Re: Default Domain Policy - Password Chg 90 days
    ... There're situations when having nonexpiring passwords can save you from trouble, for example for use with service accounts. ... "Mathieu CHATEAU" wrote in message ... Password Never Expires If selected, the password for this account never expires. ... it's not a good idea to set a password so it doesn't expire because this defeats the purpose of having passwords in the first place. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Default Domain Policy - Password Chg 90 days
    ... because this defeats the purpose of having passwords in the first place. ... for example for use with service accounts. ... Password Never Expires If selected, the password for this account never ...
    (microsoft.public.windows.server.active_directory)
  • Re: AD 2000, Blank passwords, and Group Policy
    ... the original creator of these accounts set them to 'Password ... never expires' so that won't work for me. ... I'm going to have to use your suggestion of disabling the policy ... > file though you may want to post in a Windows scripting newsgroup for that You might ...
    (microsoft.public.win2000.security)
  • Re: Password Change Policy
    ... > You can set the password never expires attribute on the accounts services ... >> next logon" setting for multiple users at a single time? ... It will affect all accounts except ... >> setting up a password change policy. ...
    (microsoft.public.win2000.active_directory)