Report AD accounts with non-expiring passwords
Documentation: Microsoft Learn
List AD accounts whose PasswordNeverExpires flag is set, including the flag and password-set timestamp for review.
Example reviewed 1 October 2026 · Illustrative output · Not a live system check
The script
Get-ADUser -Filter 'PasswordNeverExpires -eq $true' -Properties PasswordNeverExpires, PasswordLastSet |
Select-Object SamAccountName, Name, PasswordNeverExpires, PasswordLastSetScript reader
Inspect before you run
Inspect the script below. It does not run in this browser.
Inspection only — no command has run.
Show reference output
Fictional reference snapshot · 03 October 2026, 09:00 UTC. This is an example result, not a check of your systems.
SamAccountName Name PasswordNeverExpires PasswordLastSet -------------- ---- -------------------- --------------- svc-demo Demo Service True 15/04/2026 10:00:00
Inspect this example’s structure
Read the command and its supplied arguments. This example requires real PowerShell or its module; this diagram does not execute it.
Get-ADUser -Filter 'PasswordNeverExpires -eq $true' -Properties PasswordNeverExpires, PasswordLastSet |
Select-Object SamAccountName, Name, PasswordNeverExpires, PasswordLastSet- Stage 1Get-ADUser
-Filter -Properties - Stage 2Select-Object
Positional values or no named parameters
Illustrative output
This example shows the expected shape for fictional data. Your values and formatting will differ.
SamAccountName Name PasswordNeverExpires PasswordLastSet svcReport Reporting Agent True 2026-06-15 09:00:00
How it works
The single-quoted AD filter preserves $true for the Active Directory filter parser. The projection explicitly includes the flag being reported, rather than displaying unrelated default columns.
Before you run it
Use the ActiveDirectory module and directory read access. Account flags are one part of effective password behaviour; document the account’s role and any approved exception.
Check the result
Confirm each account owner and effective policy. Review safer managed service-account options where applicable. Keep reporting separate from any approved remediation changes.
If nothing is returned
A successful query found no matching accounts in the searched scope. Check the server, domain and SearchBase if you expected a known exception.