Password Expiration - Enable or Disable

Brink · 01 Jan 2014

It sounds like you may have made a mistake entering the command. Possible with the user name. Please go ahead and type net users in the elevated command prompt, press Enter, then do step 2 in OPTION TWO, and post back with a screenshot showing everything in the command prompt to see if anything may stand out.

psychotron · 01 Jan 2014

Thanks Brink. Problem was I was using 'Swen' as that's what I named my user account. After doing the new users prompt I saw Owner-1 and gave that a try and it worked.

Screenshots included.

Brink · 01 Jan 2014

You're most welcome.

Yep, that was the issue with no "Swen". Did you by chance rename "Owner-1" to have a display name of "Swen" instead?

dkotula · 13 Apr 2015

Can this be done at the group level? I would like for the administrator accounts to remain, but would like the group "Users" to expire. I am deploying local password policies and this is the only thing I have left to configure and deploy.

I have tried something like wmic group where name='Users' set PasswordExpires=True, but doesn't work.
Please enlighten me great one.
Thanks
Dave

dkotula · 13 Apr 2015

I have a script written by someone else that creates local user accounts, can something be added to make all new users have Set PasswordExpire=True. Sorry, I'm a little rusty in my coding these days.

Code:

$strComputer=$env:computername
#Input file required C:\utils\users.txt
ForEach ($user in (Import-CSV "C:\utils\CreateLocalAccounts\qtpusers.txt")){
  write-host $user.username
  write-host $user.password

#get-content "C:\utils\CreateLocalAccounts\qtpusers.txt" | ForEach-Object {
#Create the user account and assign a default password
$objOU = [adsi]"WinNT://."
$objUser = $objOU.Create("User", $user.username)
$objuser.setPassword($user.password)
$objuser.setinfo()
#Enable [User must change password at next logon]
#$objuser.PasswordExpired = 0
$objuser.PasswordLastSet = 0
$objuser.SetInfo()
#Add the User account to the local Administrators Group
$computer = [ADSI]("WinNT://" + $strComputer + ",computer") 
$group = $computer.psbase.children.find("Users")  
$group.Add("WinNT://" + $strComputer + "/" + $user.UserName)  

}

dkotula · 15 Apr 2015

Can a powershell wild card be used in Name=, for all users?
wmic path win32_useraccount where name='.*?' set passwordexpires=true

Pyprohly · 16 Apr 2015

dkotula said:

I have a script written by someone else that creates local user accounts, can something be added to make all new users have Set PasswordExpire=True. Sorry, I'm a little rusty in my coding these days.

Try tacking

Code:

wmic path Win32_UserAccount where Name="$user.username" set PasswordExpires=true

under the line

Code:

$group.Add("WinNT://" + $strComputer + "/" + $user.UserName)

dkotula said:

Can a powershell wild card be used in Name=, for all users?
wmic path win32_useraccount where name='.*?' set passwordexpires=true

You can use wildcards in WMIC but it works a little differently from PowerShell. To use wildcards in WMIC specify the "Like" operator instead of "=". Also, your wildcard symbols must abide to the WMI Query Language where percent symbols (%) represent any character and amount of characters, and an underscore (_) represents any single character.

Code:

wmic path Win32_UserAccount where "Name Like '%'" set PasswordExpires=true

But you don't even need wildcards for the task: wmic path Win32_UserAccount alone will list all users. So to set PasswordExpires=True for all user accounts, just run

Code:

wmic path Win32_UserAccount set PasswordExpires=True

dkotula · 16 Apr 2015

Works like a charm, thank you.
Do you know off hand what is used for "User must change password at next logon"?

Brink · 16 Apr 2015

dkotula said:

Works like a charm, thank you.
Do you know off hand what is used for "User must change password at next logon"?

It's to force the user to do just that when their password expires. :)

dkotula · 16 Apr 2015

Sorry, I should have specified more, I was wondering about the command to enable that feature.
It doesn't seem to be listed as an option in win32_userAccount Set, does the command reside somewhere else?