Powershell – Determine When Active Directory Password Was Last Set
Powershell script to determine the last time a user changed their password. Also displays domain password age, can it expire, and if the password is currently expired.
<#
.SYNOPSIS
Determine last time user set their password
.DESCRIPTION
Shows password max age, if expired, and last date pw was changed.
.NOTES
Author: Jonathan - [email protected]
.LINK
http://elderec.org
.PARAMETER SAMAccountName
SAMAccountName for the user in question.
.EXAMPLE
.\pw-last-set.ps1 -SAMAccountName some.user
#>
param (
[parameter(Mandatory=$true, HelpMessage="SAMAccountName for user")]$SAMAccountName
)
$root = [ADSI]''
$searcher = new-object System.DirectoryServices.DirectorySearcher($root)
$searcher.filter = "(&(objectClass=user)(sAMAccountName= $SAMAccountName))"
$user = $searcher.findall()
$User = [ADSI]$user[0].path
# get domain password policy (max pw age)
$D = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
$Domain = [ADSI]"LDAP://$D"
$MPA = $Domain.maxPwdAge.Value
# get Int64 (100-nanosecond intervals).
$lngMaxPwdAge = $Domain.ConvertLargeIntegerToInt64($MPA)
# get days
$MaxPwdAge = -$lngMaxPwdAge/(600000000 * 1440)
"Domain Max Password Age (days): " + '{0:n3}' -f $MaxPwdAge
# check if password can expire or not
$UAC = $User.userAccountControl
$blnPwdExpires = -not (($UAC.Item(0) -band 64) -or ($UAC.Item(0) -band 65536))
"Can Password Expire?: $blnPwdExpires"
# when was pw last set?
$PLS = $User.pwdLastSet.Value
# convert to int64
$lngValue = $User.ConvertLargeIntegerToInt64($PLS)
# convert to ad date
$Date = [DateTime]$lngValue
if ($Date -eq 0) {
$PwdLastSet = "<Never>"
}
else {
$PwdLastSet = $Date.AddYears(1600).ToLocalTime()
}
"Password Last Set (local time): $PwdLastSet"
# is the password expired?
$blnExpired = $False
$Now = Get-Date
if ($blnPwdExpires) {
if ($Date -eq 0) {
$blnExpired = $True
}
else
{
if ($PwdLastSet.AddDays($MaxPwdAge) -le $Now) {
$blnExpired = $True
}
}
}
"Password Expired? $blnExpired"