How To Get All Users with Password Never Expires in Active Directory

While Active Directory allows passwords to be set to never expire, this configuration should be avoided for standard user accounts due to the security risks it introduces. It is intended primarily for service accounts and select system-level accounts to support essential operations.

When this setting is legitimately required, you can follow the steps below to enable password never expires for a user.

Set password never expire for AD users using ADUC

• Open Server Manager and click on Tools » Active Directory Users and Computers.
• Navigate to the relevant OU or container.
• Double-click the target user account and go to the Account tab.
• Select the Password never expires checkbox, then click Apply and OK to save the changes.

Enable password never expire for users using PowerShell

To configure a user account with a non-expiring password, use the cmdlet below, substituting <Identity> with any of these attributes: Distinguished Name, Object GUID, Security Identifier (SID), or SAM account name.

Set-ADUser -Identity "<Identity>" -PasswordNeverExpires $true

• With AdminDroid, you can directly enable “Password Never Expires” for a user using the Update User Properties management action.
• In the Update User Properties fly-out pane, select the desired user. Then, choose Password Never Expires from the Select Property drop-down and set it to Yes.
• Then, click Execute to apply the changes.

Users often reuse their previous passwords when updating their credentials in Active Directory. This weakens security and increases the risk of compromise.

To prevent this, admins can enforce password history policies that remember a specified number of previous passwords and block their reuse. This ensures that users create a unique password whenever they change it.

Configure enforce password history policy in Active Directory

• In the Group Policy Management Console (GPMC), expand the domain, right-click on Default Domain Policy and select Edit.
• Navigate to Computer Configuration » Policies » Windows Settings » Security Settings » Account Policies » Password Policy
• Double-click Enforce password history, and in the Security Policy Setting tab, select the Define this policy setting checkbox.
• Set a value between 1 and 24 to specify how many past passwords users are not allowed to reuse.

Set password history policy in Active Directory Using PowerShell

Rather than navigating through GPMC, you can simply run the cmdlet below to change the default domain policy and specify how many previous passwords the domain should remember.

Set-ADDefaultDomainPasswordPolicy -Identity "<DomainName>" -PasswordHistoryCount "<PasswordReuseCount>"

Note: Replace <DomainName> with the name of your domain and <PasswordReuseCount> with number of passwords to be remembered.

For user accounts, setting the password to never expire creates a security vulnerability, making them valuable targets for lateral movement after a compromise. While this setting is essential for service accounts to perform necessary operations, it must be disabled for all user accounts to avoid persistent access by attacker. Therefore, disabling "password never expires" option for users will improve their overall account protection.

Therefore, disabling "password never expires" option for users will improve their overall account protection.

Disable password never expire for a user in Active Directory

• In the ADUC console, browse through the relevant containers or OUs to locate the desired user account.
• Select the user and right-click on the user account and click on Properties.
• Navigate to the Account tab and click on Password never expires option in the Account options.
• If the option is enabled uncheck the Password never expires checkbox and Click on Apply and select OK.

Bulk remove password never expire for users using PowerShell

Manually going through each user account to disable the “password never expires” option is a tedious and time-consuming task. This is why PowerShell is used to efficiently disable the setting for multiple users at once.

• To proceed, prepare a CSV or TXT file containing a unique identifiers like distinguished name/object GUID/object SID/SAM account name of each user as shown here.
• Then, replace the <FilePath> in the cmdlet below and execute it to disable never expire password for the list of target users.

Import-Csv "<FilePath>" -header ‘Identity’ | ForEach-Object { 
$User = Get-ADUser -Identity $_.Identity -Properties PasswordNeverExpires, Enabled 
     if ($User.PasswordNeverExpires -and $User.Enabled) { 
         Set-ADUser -Identity $_.Identity -PasswordNeverExpires $false 
         Write-Host "Password never expire is removed for $($_.Identity)" 
     } 
     else { 
         Write-Host "Password never expire is already disabled for $($_.Identity)" 
    } 
}