Reads the computed password expiry attribute for every enabled account whose password can expire and lists the ones inside the warning window, marking those that already expired. Working from the computed attribute rather than the last-set date means fine-grained password policies are handled correctly.
powershell
# Report Expiring AD Passwords
# Single use case: list users whose password expires within N days
#-----------------------------------------------------------------
function Write-Log {
param($Message)
Write-Host "<WRITE-LOG = `"*$Message*`">"
}
# --- Parameters (replace via ServerEngine API parameters if needed) ---
$WarnDays = 14
if (-not (Get-Module -ListAvailable -Name ActiveDirectory)) {
Write-Log "ActiveDirectory module not available on this host!"
return
}
Import-Module ActiveDirectory
$deadline = (Get-Date).AddDays([int]$WarnDays)
Write-Log "Searching passwords expiring before $($deadline.ToString('yyyy-MM-dd'))..."
$users = Get-ADUser -Filter { Enabled -eq $true -and PasswordNeverExpires -eq $false } `
-Properties "msDS-UserPasswordExpiryTimeComputed", EmailAddress |
ForEach-Object {
$raw = $_."msDS-UserPasswordExpiryTimeComputed"
if ($raw -and $raw -gt 0 -and $raw -lt 9223372036854775807) {
$expires = [datetime]::FromFileTime($raw)
if ($expires -le $deadline -and $expires -gt (Get-Date).AddYears(-30)) {
[pscustomobject]@{ Sam = $_.SamAccountName; Name = $_.Name; Expires = $expires }
}
}
} | Sort-Object Expires
if (-not $users) {
Write-Log "No passwords expire within $WarnDays days."
return
}
Write-Log "================ Expiring Passwords ($(@($users).Count)) ================"
foreach ($u in $users) {
$state = if ($u.Expires -lt (Get-Date)) { "EXPIRED" } else { "expires" }
Write-Log "$state: [$($u.Expires.ToString('yyyy-MM-dd HH:mm'))] $($u.Sam) ($($u.Name))"
}
Write-Log "Password expiry report complete: $(@($users).Count) account(s) within $WarnDays days."Run it across your fleet
This script runs as-is on a single host. Paste it into ServerEngine to schedule it, run it on a whole server group in parallel, and keep the credentials out of the file — see the scripts documentation and the credential store.
More in Active Directory
Active Directory User Onboarding with PowerShell
2026-08-17Active Directory User Offboarding with PowerShell
2026-08-17Disable an Active Directory User with PowerShell
2026-08-17Enable an Active Directory User with PowerShell
2026-08-17Unlock an Active Directory Account with PowerShell
2026-08-17Reset an Active Directory Password with PowerShell
2026-08-17Ready when you are.
Try ServerEngine free for 7 days.