Powershell to get local users password age

hi all,

i have managed find script pull out various info local users including password ages.

my plan email local accounts tell them there password expire.

im not best when comes powershell bare me :)

need guide me in right direction.
want list local users have password age on 85 days , go on email them
please help!

see below script have:

param ( [parameter(position=0,mandatory=$false)] [validatenotnullorempty()] [alias('cn')][string[]]$computername=$env:computername, [parameter(position=1,mandatory=$false)] [alias('un')][string[]]$accountname, [parameter(position=2,mandatory=$false)] [alias('cred')][system.management.automation.pscredential]$credential )  $obj = @() $now = get-date foreach($computer in $computername) { if($credential) {     $alllocalaccounts = get-wmiobject -class win32_useraccount -namespace "root\cimv2" `     -filter "localaccount='$true'" -computername $computer -credential $credential -erroraction stop } else {     $alllocalaccounts = get-wmiobject -class win32_useraccount -namespace "root\cimv2" `     -filter "localaccount='$true'" -computername $computer -erroraction stop }  foreach($localaccount in $alllocalaccounts) {        $rawpwage = ([adsi]"winnt://$computer/$($localaccount.name),user").passwordage.value     $obj = $alllocalaccounts | foreach-object {          $user = ([adsi]"winnt://$computer/$($_.name),user")          $pwage    = $user.passwordage.value          $maxpwage = $user.maxpasswordage.value          $pwlastset = $now.addseconds(-$pwage)           new-object -typename psobject -property @{            'name'                 = $_.name            'full name'            = $_.fullname            'lockout'              = $_.lockout            'password expires'     = $_.passwordexpires            'password required'    = $_.passwordrequired            'account type'         = $_.accounttype            'domain'               = $_.domain            'password last set'    = $pwlastset            'password age'         = ($now - $pwlastset).days            'password expiry date' = $now.addseconds($maxpwage - $pwage)            'description'          = $_.description          }        } }  if($accountname) {     foreach($account in $accountname)     {         $obj|where-object{$_.name -like "$account"}     } } else {     $obj } }

hello leigham,

an interesting thread , script sure. think on complicating trying do.

if trying date user last changed password.

get-aduser <user> -property pwdlastset

the property pwdlastset can converted , calculated fin if old x days... 

then calculation. of want in script already... but, not using ad cmdlets make life much, easier... here example... http://ps1scripting.blogspot.com/2012/07/active-directory-user-password.html

he makes simple... passwordlastset , calculate when expire (that data in ad way - constructed attribute called... msds-userpasswordexpirytimecomputed). 

either way, users, attributes need, loop through in script above... (foreach $user in $users){blah} , calculate... if expiry time < 85 days today send email... 

---

kevin sullivan - program manager

Windows Server  >  Windows PowerShell