Password Expiration - Enable or Disable

How to Enable or Disable Password Expiration for a User in Windows 7 and Windows 8​

   Information

Password expiration allows you to set a maximum password age in days (42 by default) of a user account before it expires and they must change their password.

By default, password expiration is disabled. This will show you how to enable or disable password expiration for a user in Windows 7.

   Note

You can only do this while logged in as an administrator.

In Windows 8, this only applies to local accounts, and not Microsoft accounts.

EXAMPLE: Password Expiration
NOTE: This is what a user will see at log on when the maximum password age is reached and they are required to change their password.

OPTION ONE

Through Local Users and Groups Manager

1. Open the Local Users and Groups Manager.

2. In the left pane, click on Users, then double click on the name of the user account that you want to enable or disable password expiration for. (see screenshot below)

3. To Enable Password Expiration for this User Account
A) Uncheck the password never expires box, then click on OK. (see screenshot below)

B) You will now need to change the maximum and minimum password age of this user account for what you would like.

C) Go to step 5.
4. To Disable Password Expiration for this User Account
A) Check the password never expires box, then click on OK. (see screenshot above)
NOTE: If password never expires is grayed out, then this means that this user account as reached it's set maximum password age. You will need to either change the maximum password age to more days so that it has not expired yet, or change the password for the user account in Windows 7 or Windows 8.
5. Repeat steps 2 to 3/4 for any other user account that you want to enable or disable password expiration for.

6. When done, close the Local Users and Groups Manager.

OPTION TWO

Through an Elevated Command Prompt

1. Open an elevated command prompt in Windows 7 or Windows 8.

2. Do step 3, 4, 5, or 6 below for what you would like to do.


3. To Disable Password Expiration for a User Account
A) In the elevated command prompt, type the command below, press Enter, and go to step 7 below. (see screenshot below)
NOTE: Substitute username in the command below with the actual user account name that you want to disable password expiration for.

wmic UserAccount where Name='[B][COLOR=red]username[/COLOR][/B]' set PasswordExpires=False

FOR EXAMPLE: I would type in this command exactly for a user account named Brink, and press enter.

wmic UserAccount where Name='Brink' set PasswordExpires=False

B) Go to step 4.
4. To Disable Password Expiration for All User Accounts on PC
A) In the elevated command prompt, type the command below, press Enter, and go to step 7 below. (see screenshot below)

wmic UserAccount set PasswordExpires=False

5. To Enable Password Expiration for a User Account
A) In the elevated command prompt, type the command below, press Enter, and go to step 7 below. (see screenshot below)
NOTE: Substitute username in the command below with the actual user account name that you want to enable password expiration for.

wmic UserAccount where Name='[B][COLOR=red]username[/COLOR][/B]' set PasswordExpires=True

FOR EXAMPLE: I would type in this command exactly for a user account named Brink, and press enter.

wmic UserAccount where Name='Brink' set PasswordExpires=True

B) You will now need to change the maximum and minimum password age of this user account for what you would like.
6. To Enable Password Expiration for All User Accounts on PC
A) In the elevated command prompt, type the command below, press Enter, and go to step 7 below. (see screenshot below)

wmic UserAccount set PasswordExpires=True

B) You can now change the maximum and minimum password age of each user account for what you would like.
7. Close the elevated command prompt.

That's it,
Shawn

Related Tutorials

---

• How to Change Maximum and Minimum Password Age in Windows 7 and Windows 8
• How to Change the Password for Your or Another User Account in Windows 7
• How to Create a Password for a Windows 7 User Account
• How to Reset the Password of a User Account in Windows 7
• How to Make Windows 7 Require a User Name and Password at Log On
• How to Add or Remove Change Password from the CTRL+ALT+DEL Screen
• How to Create a Windows 7 Password Reset Disk
• How to Use System Restore to Change User Account Password
• How to Change the User Account Password if Unable to Login to Windows
• How to Enable or Disable Password must meet Complexity Requirements
• How to Set Account Lockout Threshold for Invalid Logon Attempts
• How to Set Account Lockout Duration for Locked Out User Accounts
• How to Set the Reset Account Lockout Counter After Setting
• How to Enable or Disable Windows 7 Password History Enforcement
• How to Change the Time to Warn a User to Change Password Before Expiration
• How to Prevent or Allow a User to Change their Password in Vista and Windows 7
• How to Remove the Password for Your or Another User Account in Windows 7
• How to View Detailed Information About All User Accounts on a Windows PC

 

[Pyprohly]

It doesn't seem to be listed as an option in win32_userAccount Set, does the command reside somewhere else?

There's not a direct command for that AFAIK. PowerShell, however, has the ability to force a user to change their password at next logon... And if PowerShell can do that, the Command Prompt can too. So I guess there is a command for that.

PowerShell command

[adsi]'WinNT://./[COLOR="Red"]Pyprohly[/COLOR]' | %{$_.PasswordExpired = 1; $_.SetInfo()}

Command Prompt command

powershell "[adsi]'WinNT://./[COLOR="red"]Pyprohly[/COLOR]' | %{$_.PasswordExpired = 1; $_.SetInfo()}"

N.B. For the above commands to work, the user account's password must, of course, be set to expire. And your Shell must be elevated.

 

[dkotula]

That would be a one time option for forcing a password change, but in a password policy situation we would need that to happen every time the password expires. Does this mean that I would have to manually remove the checkmark on each client.

Sorry I should have mentioned we are not in a domain environment as our endpoint computers are spread out all over multiple states and joining them to a domain is a problem because of distance and bandwidth. I would love to have them in AD with the ability to control them better.

I am using Kaseya to push out scripts to the machines, and what I am trying to do is as follows:
User must change password at next logon.
Minimum Password Length
Password Expiry warning 10 days
MaxPasswordAge 90 Days
Alphanum Pwds
Password History

Some of these settings I am changing the registry and some I am using script or power shell, I can't seem to find all the settings in on place in windows 7 Pro, unless I make changes manually.
Am I shooting myself in the foot?

 

[Pyprohly]

I must admit I'm a little lost with what you are asking. Are you shooting yourself in the foot? I don't know. What problem exactly are you facing?

That would be a one time option for forcing a password change, but in a password policy situation we would need that to happen every time the password expires.

When a user's password expires, that user will be forced to change their password upon the next login they make. This behaviour already is already enabled and can't be set differently.

Sorry I should have mentioned we are not in a domain environment [...]

Sorry, I should have mentioned that the commands in my post above do not work for a domain environment. Only on local accounts to a machine.

I am using Kaseya to push out scripts to the machines, and what I am trying to do is as follows:
User must change password at next logon.
Minimum Password Length
Password Expiry warning 10 days
MaxPasswordAge 90 Days
Alphanum Pwds
Password History

What you are trying to do isn't clear to me. Are you in search of the command equivalent to each of the above?

 

[dkotula]

Sorry, I was away taking some classes last week.
I am able to push out some password policy scripts, but it seems I have to do this from multiple locations. Some I am pushing out by changing registry settings, and others I am changing using PowerShell. Is there a way of using a script to perform all the changes from one common location? Above was a small list of the things I'm pushing out, and they work, I'm sure there is a much easier way to accomplish this. I would love to be able to do this from AD but because of the distance between all of the locations, we cannot join our systems to a domain which limits me to workgroup configurations.

 

[Pyprohly]

Sorry for my delay. It's difficult to keep track of members' issues that reside within the threads of tutorials.

As what you're asking no longer relates to the topic of this tutorial, I recommend you describe your issue in a new thread of it's own. Your chance of receiving an answer there, and the rate at which you'll receive replies will triple.

 

[Bern2b]

Password change enable/disable in Win 7 Home Premium

Hi,

All explanation here are for Windows Professional but do not work with Home Premium.

This is a new embarassing option that I didn't have before.

Please tell me how to stop it?

Thanks,
Bernard

 

[Brink]

Hello Bernard, and welcome to Seven Forums.

You could use OPTION TWO in the tutorial in any edition of Windows.

 

[Bern2b]

Thank you Brink, I did it and I get :

C:\Users\Bernard>wmic path Win32_UserAccount set PasswordExpires=False
Updating property(s) of '\\BERNARD-PC\root\cimv2:Win32_UserAccount.Domain="Berna
rd-PC",Name="Administrator"'
Property(s) update successful.
Updating property(s) of '\\BERNARD-PC\root\cimv2:Win32_UserAccount.Domain="Berna
rd-PC",Name="Bernard"'
ERROR:
Description = Generic failure

So what is it?

Regards,
Bernard

 

[Brink]

It looks like you didn't run the command in an elevated command prompt.

http://www.sevenforums.com/tutorials/783-elevated-command-prompt.html

 

[dorian mode]

Thank you Brink for this very helpful tutorial.