How do I write a script to modify the password expiration values for users on a Windows Server?

Question

I need to create several users on Windows 2008 servers and modify the password expiration value to "Never". These will be local (not AD) users. I can create them using "net user", it's modifying the pass expiry that is killing me. If I do a "net user username" it lists the field and its value, but there is no switch (at least not one that the help file references) to modify it, and most of the solutions I saw online suggested installing 3rd party tools, however this solution must be native to Windows (ideally using Powershell). Any help is appreciated.

UPDATE

I said if I figured out how to do this in Powershell I would post it here, and I am a man of my word.

Get-WmiObject -Class Win32_UserAccount -Filter "name = 'steve'" | Set-WmiInstance -Argument @{PasswordExpires = 0}

This is a boolean value so if you wanted to set a password to expire just change 0 to 1. This is beautiful to me in its simplicity, and I have tested this method updating other WMI objects and it works every time.

Aden

Do you need a script to do this, or do you just need to do this once? – Teresaterese

This is a perfectly valid question, and considering you want to do it with a script, would be nonsensical to migrate to Super User. I modified the title a little to help make your question clearer. +1 from me. – Elephantine

Answer 1

The simple solution is to create a batch file that issues the following command:

net accounts /maxpwage:unlimited

However, that will set the maximum password age for all accounts on the local machine to unlimited, not just the new accounts that you have created.

If you need a finer level of control (i.e., the ability to set the password expiration values for individual users), you'll need something a little more complicated. The Scripting Guys share an example of a VBScript that will modify a local user account so that its password never expires:

Const ADS_UF_DONT_EXPIRE_PASSWD = &h10000 

strDomainOrWorkgroup = "Fabrikam" 
strComputer = "atl-win2k-01" 
strUser = "KenMeyer" 

Set objUser = GetObject("WinNT://" & strDomainOrWorkgroup & "/" & _ 
    strComputer & "/" & strUser & ",User") 

objUserFlags = objUser.Get("UserFlags") 
objPasswordExpirationFlag = objUserFlags OR ADS_UF_DONT_EXPIRE_PASSWD 
objUser.Put "userFlags", objPasswordExpirationFlag  
objUser.SetInfo 

It would be easy to modify this to work for any user of your choice, or even to create a new user.

Finally, here's an example in C#, which you should be able to port to PowerShell. I'm not much of a PS expert, but considering it uses the .NET Framework, the above code should give you some ideas.

Elephantine

Thx, I will look at these solutions. This is for a script, I am trying to completely automate application server setup for a webfarm, and there are a few pieces that I haven't been able to figure out how to easily script (like this one)...If I figure out how to convert the C# to powershell I will post that here as well (these scripts are all written in powershell). Thx again, FYI I love the Scripting Guys... – Aden

Answer 2

From this technet thread.

$computer = $env:Computername
$account = ([adsi]"WinNT://$computer/TestAccount")
$account.PasswordExpired = 1
$account.psbase.commitchanges()

You can add the domain before the computer name if you need to.

Tiepolo

Nice. I don't use WMI all that much, so I didn't think to look there. – Tiepolo

Forgot to mention...your script above set the actual expired flag, not the willexpire flag. But thx for the help anyway... – Aden

Answer 3

Set password never expires for local user. Do not change other flags:

$ADS_UF_DONT_EXPIRE_PASSWD = 0x10000

$username = 'user'
$user = [adsi] "WinNT://./$username"
$user.UserFlags = $user.UserFlags[0] -bor $ADS_UF_DONT_EXPIRE_PASSWD
$user.SetInfo()

ADS_USER_FLAG_ENUM enumeration

Meredithmeredithe

Answer 4

works for me:

WMIC USERACCOUNT WHERE "Name='ftpuser'" SET PasswordExpires=FALSE

replace ftpuser with correct user name

Osmunda

Answer 5

The other solutions weren't working for me so I tweaked Jason's solution to:

$svrname = $env:computername
$user = ([adsi]"WinNT://$svrname/Administrator")
$user.userflags = 66049
$user.psbase.commitchanges()

The userflags value determines what tickboxes are checked for the user - this one is a basic "password doesn't expire" value. Can't seem to work out how it the numbers go together, the below may be useful but according to that I've got a reserved value enabled which doesn't make sense.

http://www.selfadsi.org/ads-attributes/user-userAccountControl.htm

Instead I just enabled the options I needed on a test box and retrieved the value. Is the most reliable means of determining what you need I guess.

Bailee

Answer 6

I took Deadly-Bagel's solution and it didn't work, until I made a small change. See below:

$svrname = $env:computername
$user = ([adsi]"WinNT://$svrname/Administrator")
$user.psbase.InvokeSet("userflags", 66049)
$user.psbase.commitchanges()

Sprit