SERVER-001 · Script
Audit Directory Password Aging
Lists directory accounts whose passwords are expiring soon, already expired, or set to never expire.
Version 1.0.0Language PowerShellUpdated November 2026Report only, changes nothing
What it does
Read-only. Checks enabled user accounts (or every account with -IncludeDisabled) and saves a dated CSV in the Reports folder. Each account gets one status:
- Expired: the password has passed its expiration date
- Expiring: the password expires within -WarnDays days
Never expires the account is set so its password never expires
- Must change: the account must set a new password at next sign-in
- OK: none of the above
Uses the expiration date the domain itself calculates, so fine-grained password policies are respected.
Requirements
Windows PowerShell 5.1 and the ActiveDirectory module (RSAT). Any domain user can read these attributes.
How to run it
- Run as: a service account with the directory rights the script lists, or SYSTEM on a domain controller or the server being checked
- Run from: a domain-joined management server or admin workstation with the RSAT tools, as a scheduled task or from your management tool
- Script type: PowerShell 5.1, 64-bit
- User interaction: none; the script never prompts
- Timeout: 30 minutes for large directories or many servers
Settings
| Name | What it does | Options | Default |
|---|---|---|---|
| WarnDays | Days before expiration that count as Expiring. Default: 14. | 14 | |
| SearchBase | Optional OU to check, as a distinguished name. Default: the whole domain. | ||
| IncludeDisabled | Also check disabled accounts. | False | |
| ExcludeAccounts | Account names (sAMAccountName) to leave out, for example service accounts you already track. | (none) | |
| AlertOn | When to exit with code 1 so a monitoring tool raises an alert. Never (default), Expiring (expiring or expired), NeverExpires, or Any. | Never, Expiring, NeverExpires, Any | Never |
| Server | Optional domain controller to query. Default: the nearest one. |
Exit codes
- 0 = Completed (no alert condition)
- 1 = Accounts match the AlertOn setting
- 2 = Script error (see log)
Testing steps
- Run it on one test OU, test account or test server and check the output and log.
- Check the exit code: 0 = OK, 1 = needs attention, 2 = error (see log), 9 = this copy is past its Valid until date.
- Roll out to a small group next, then everyone.
Rollback steps
Report only. Nothing is changed, so nothing needs to be rolled back.
Version and change log
| Version | Date | Changes |
|---|---|---|
| 1.0.0 | November 2026 | First release. |