In tip 8485, we calculated a user's approximate password expiration date.
Using Findexpacc.exe, a freeware command-line Active Directory query tool to find accounts with expired passwords, or expired accounts, available at the bottom of this tip, I have scripted PwdExp.bat to return accounts whose password has expired, or will expire in days days in the future.
The syntax for using PwdExp.bat is:
PwdExp \[days\]
Where days is an optional parameter that will advance the cacluation by days in the future. If you wanted to return the user account whose password will be expired in 10 days, use PwdExp 10. This includes those accounts who password is already expired.
When you run PwdExp.bat, the output is displayed on the console in the following semi-colon delimited format:
"User Distinguished Name";"User SAMID";"User Email Address";Password_Last_Set_YYYYMMDDHHmmSS;Password_Age_In_DaysYou can redirect the output to a file using PwdExp \[days\]>FileName.
You can process the output in a batch using:
for /f "Tokens=*" %%a in ('pwdexp 10') do ( call :process %%a ) ... ... endlocal goto :EOF :process set dn=%1 set samid=%2 set email=%3 set pls=%4 set age=%5 ... ... goto :EOFPwdExp.bat contains:
@echo off setlocal ENABLEDELAYEDEXPANSION set wrk=%TEMP%\PwdExp_%RANDOM% set wrk1="%wrk%.tm1" set wrk2="%wrk%.tm2" if exist %wrk1% del /q %wrk1% set /a days=0 if not \{%1\}==\{\} set /a days=%1 set qry=findexpacc -pwd -ps 1000 -days %days% call :quiet 2>>nul if not exist %wrk1% goto :finish sort %wrk1% /O %wrk2% del /q %wrk1% for /f "Tokens=1-7 Delims=»" %%a in ('type %wrk2%') do ( call :PwdExpOut %%a %%b %%c %%d %%e %%f %%g ) del /q %wrk2% :finish endlocal goto :EOF :PwdExpOut set dn=%1 set samid=%4 set email=%7 set pls=%5 set pls=%pls:"=% for /f "Tokens=1-6 delims=/-:" %%i in ('@echo %pls%') do ( set YY=%%i set MM=%%j set DD=%%k set HH=%%l set TT=%%m set SS=%%n ) set pls=%YY%%MM%%DD%%HH%%TT%%SS% set age=%6 set age=%age:"=% set /a age=10000%age%%%10000 @echo %dn%;%samid%;%email%;%pls%;%age% goto :EOF :quiet for /f "Tokens=*" %%u in ('%qry%^|findstr /b /l /C:""""') do ( set wrk=%%u set wrk=!wrk:","="»"! @echo !wrk!>>%wrk1% )