How to Find All Expired Active Directory Passwords using PowerShell

Proactive Password Management

In a standard Active Directory environment, users are prompted to change their passwords every 30, 60, or 90 days based on the domain’s Default Domain Policy. If a user goes on extended medical leave, or if a service account password expires, the account is locked and the user cannot log in. For service accounts, this can cause critical backend database processes to fail silently.

Instead of waiting for users to complain that they are locked out, system administrators can proactively query Active Directory using PowerShell to generate a report of all accounts whose passwords have already expired, or are about to expire in the next 7 days.

Step 1: Import the Active Directory Module

To execute these queries, you must run PowerShell as an Administrator on a domain-joined machine with the RSAT tools installed.

Import-Module ActiveDirectory

Step 2: Find All Currently Expired Passwords

The Search-ADAccount cmdlet has a built-in parameter designed specifically for this task. It automatically cross-references the user’s PasswordLastSet attribute with the domain’s MaxPasswordAge policy.

To find all users whose passwords have already expired and are currently locked out, run the following command:

Search-ADAccount -PasswordExpired | Select-Object Name, SamAccountName, PasswordExpired

This command returns a clean, easy-to-read table displaying the name and username of every offending account.

Step 3: Filter Out Disabled Accounts

When an employee leaves the company, their account is usually disabled, but their password will eventually expire anyway. The previous command will include all of those disabled accounts, cluttering your report. You can pipe the results into a Where-Object filter to ensure you are only looking at active employees:

Search-ADAccount -PasswordExpired | Where-Object { $_.Enabled -eq $True } | Select-Object Name, SamAccountName

Step 4: Find Passwords About to Expire

The most useful proactive trick is to find passwords that are going to expire soon, so you can send the user a warning email.

You can use the -PasswordExpiresIn parameter to specify a time limit (e.g., the next 7 days). Because PowerShell requires a formal TimeSpan object, we must format it as Days.Hours:Minutes:Seconds.

Search-ADAccount -PasswordExpiresIn "7.00:00:00" | Where-Object { $_.Enabled -eq $True } | Select-Object Name, SamAccountName

Exporting the Results to CSV

If you want to send this list to the IT Helpdesk so they can begin contacting users, append the Export-Csv cmdlet to the end of the pipeline:

Search-ADAccount -PasswordExpired | Where-Object { $_.Enabled -eq $True } | Select-Object Name, SamAccountName | Export-Csv -Path "C:\Temp\ExpiredPasswords.csv" -NoTypeInformation

You now have a perfectly formatted Excel spreadsheet detailing exactly which accounts need immediate administrative intervention.