Set account passwords in Active Directory to not expire using script

[Shammikit]

hello,is there some sort of script to untick "change password at next logon" and tick "password never expire" option for all accounts in a specific OU in Server 2012 R2? I know its possible to do this using GUI, but i want to do this programmatically for reasons. I have found this code and tried running it in powershell. i get the message it was successfully executed but no change has been actually done. would like to know if there is a proper code to achieve this. Thanks

dsquery user “OU={your target OU},DC={your domain},DC={your domain extension}” | dsmod user -pwdneverexpires yes

 

[leadeater]

26 minutes ago, Shammikit said:

hello,is there some sort of script to untick "change password at next logon" and tick "password never expire" option for all accounts in a specific OU in Server 2012 R2? I know its possible to do this using GUI, but i want to do this programmatically for reasons. I have found this code and tried running it in powershell. i get the message it was successfully executed but no change has been actually done. would like to know if there is a proper code to achieve this. Thanks

dsquery user “OU={your target OU},DC={your domain},DC={your domain extension}” | dsmod user -pwdneverexpires yes

 

Use powerhsell for it. 

 

Import-Module ActiveDirectory
Get-ADGroupMember -Identity "TestGroup" | Set-ADUser -PasswordNeverExpires:$True

Just replace 'Test Group' with your own like 'Domain Users'.

[Shammikit]

10 minutes ago, leadeater said:

Use powerhsell for it. 

 

Import-Module ActiveDirectory
Get-ADGroupMember -Identity "TestGroup" | Set-ADUser -PasswordNeverExpires:$True

Just replace 'Test Group' with your own like 'Domain Users'.

should 'Test Group' be replaced by the name of the OU? I just tried the 2 commands that u quoted and replaced 'Test Group' with my OU name and it gave me an error saying cannot find an object name with the identity. I doubled checked spellings of my OU name.

[leadeater]

5 minutes ago, Shammikit said:

should 'Test Group' be replaced by the name of the OU? I just tried the 2 commands that u quoted and replaced 'Test Group' with my OU name and it gave me an error saying cannot find an object name with the identity. I doubled checked spellings of my OU name.

No it's not done by OU it's done by AD group membership. By default every account is a member of Domain Users.

 

If you need it done by OU then

 

Get-ADUser -Filter * -SearchBase “ou=ouname,dc=company,dc=com” | Set-ADUser -PasswordNeverExpires:$True

 

[Shammikit]

10 minutes ago, leadeater said:

No it's not done by OU it's done by AD group membership. By default every account is a member of Domain Users.

 

If you need it done by OU then

 

Get-ADUser -Filter * -SearchBase “ou=ouname,dc=company,dc=com” | Set-ADUser -PasswordNeverExpires:$True

 

I think its working.

Does this code make password to never expire enabled when creating an account also? I made a couple of test accounts and it looks like it

[leadeater]

14 minutes ago, Shammikit said:

I think its working.

Does this code make password to never expire enabled when creating an account also? I made a couple of test accounts and it looks like it

No, it will only change existing accounts. Group Policy has configuration for setting default user account properties like that.

 

https://www.top-password.com/blog/set-password-to-never-expire-for-domain-accounts-in-windows-server/