How to Get a List of Users with Password Never Expires

Using a password expiration policy is a best practice that makes it harder for attackers to crack user credentials. Most organizations enforce a password expiration period (for example, 90 days) on regular user accounts, but in some cases, administrators set password to never expire for select domain user accounts in Microsoft Windows Server 2016, 2012, 2008, 2003. However, letting this practice spiral out of control can seriously jeopardize IT security. To keep tabs on accounts exempt from password expiration, many administrators turn to the trusty Active Directory module for Windows PowerShell, performing an AD query to list users with the Password Never Expires attribute set to “True.” But is running Windows PowerShell commands with the Get-ADUser cmdlet the most efficient way to do this? Isn’t it bothersome to do on a regular basis?

Instead of using PowerShell to find users with the Password Never Expires setting, why don’t you try Netwrix Auditor for Active Directory? In a few clicks, you can quickly have a list of all Active Directory users who have the Password Never Expires flag set on their account right now, or had it set at any moment in the past. You can also have the report generated and emailed to you automatically, facilitating regular review. The solution can even alert you whenever an administrator changes an account’s settings to make the password never expire. As a result, you’ll get stronger security with far less effort.