User Tools

Site Tools


networking:windows:active_directory:ad_password_policy

Active Directory Password Policy

Check a User's Password and Policy

Check when a user password expires:

net user USERNAME /domain

Get-ADUserResultantPasswordPolicy USERNAME

Default Domain Password Policy

Get-ADDefaultDomainPasswordPolicy

Default Domain Password Policy

Fine-Grained Password Policy

Show Fine-Grained Password Policies

Get-ADFineGrainedPasswordPolicy -Filter *

Show Per User Policy

Get-ADUserResultantPasswordPolicy username

Or to show all users:

function Get-MTUserPasswordPolicy ($Identity)
{
    $Fgpp = (Get-ADUserResultantPasswordPolicy -Identity $Identity).Name
    [string]$Policy = switch ($Fgpp)
    {
        $null {"Default Domain Policy"}
        {!($null)} {$Fgpp}
    }
    
    $Return = New-Object -TypeName PSObject
    $Return | Add-Member -MemberType NoteProperty -Name Identity -Value $Identity
    $Return | Add-Member -MemberType NoteProperty -Name PasswordPolicy -Value $Policy
    
    return $Return
}

Then call the function:

Get-ADUser -Filter {Enabled -eq $True} | ForEach-Object {Get-MTUserPasswordPolicy -Identity $_.SamAccountName}
networking/windows/active_directory/ad_password_policy.txt · Last modified: 2020/09/28 10:51 by gcooper