{"id":66143,"date":"2006-10-31T14:14:00","date_gmt":"2006-10-31T14:14:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2006\/10\/31\/how-can-i-configure-an-active-directory-account-so-the-password-never-expires\/"},"modified":"2006-10-31T14:14:00","modified_gmt":"2006-10-31T14:14:00","slug":"how-can-i-configure-an-active-directory-account-so-the-password-never-expires","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/how-can-i-configure-an-active-directory-account-so-the-password-never-expires\/","title":{"rendered":"How Can I Configure an Active Directory Account So the Password Never Expires?"},"content":{"rendered":"

\"Hey, \n

Hey, Scripting Guy! How can I configure an Active Directory user account so that the account password never expires?

— BB<\/P>\"Spacer\"\"Hey,\"Script<\/A> \n

Hey, BB. Before we start we have a question for you<\/I>: wouldn\u2019t you agree that Catch-22<\/I> is one of the four greatest novels ever written? We ask that because, in his English class, the Scripting Son was recently asked to select, and read, a book from a list provided by the teacher. \u201cHey, Scripting Dad,\u201d he said. \u201cHave you read any of these books? Are any of them any good?\u201d<\/P>\n

\u201cGood heavens, Scripting Son!\u201d replied the Scripting Dad. \u201cCatch-22<\/I> is on the list! Catch-22<\/I> is one of the four greatest novels ever written. Everyone<\/I> knows that.\u201d<\/P>\n

\u201cOK, I guess I\u2019ll read that one,\u201d replied the Scripting Son.<\/P>\n

Of course, ever since then the Scripting Dad has had to listen to an unending litany of complaints:<\/P>\n\n\n\n\n\n\n
\u2022<\/TD>\n\n

\u201cThis book is weird.\u201d<\/P><\/TD><\/TR>\n

\u2022<\/TD>\n\n

\u201cThis book doesn\u2019t make any sense.\u201d<\/P><\/TD><\/TR>\n

\u2022<\/TD>\n\n

\u201cI thought you said this was a good<\/I> book.\u201d<\/P><\/TD><\/TR>\n

\u2022<\/TD>\n\n

\u201cThis is all your fault.\u201d<\/P><\/TD><\/TR><\/TBODY><\/TABLE>\n\n<\/THEAD>\n\n\n
\n

Note<\/B>. Actually that last one has nothing to do with Catch-22<\/I>. That\u2019s just a standard complaint the Scripting Dad hears every day.<\/P><\/TD><\/TR><\/TBODY><\/TABLE>\n

<\/DIV>\n

In order to fight fire with fire, the Scripting Dad is looking for people who agree with him that Catch-22<\/I> is one of the four greatest novels ever written. Can he count on your support, BB? OK, what if he sweetens the deal by giving you a script that can configure an Active Directory user account so that the account password never expires:<\/P>

Const ADS_UF_DONT_EXPIRE_PASSWD = &h10000<\/p>\n
Set objUser = GetObject(“LDAP:\/\/cn=Ken Myer, ou=Finance, dc=fabrikam, dc=com”)<\/p>\n
intUserAccountControl = objUser.Get(“userAccountControl”)<\/p>\n
If Not objUser.userAccountControl AND ADS_UF_DONT_EXPIRE_PASSWD Then\n    objUser.Put “userAccountControl”, _\n        objUser.userAccountControl XOR ADS_UF_DONT_EXPIRE_PASSWD\n    objUser.SetInfo\nEnd If\n<\/PRE>\n
What do you mean, \u201cThat\u2019s still not good enough\u201d? Wow; you\u2019re a tough negotiator, BB. OK, how about this: how about we explain how this script works? Deal? Deal.<\/P>\n
As you can see, the script starts out by defining a constant named ADS_UF_DONT_EXPIRE_PASSWD and assigning this constant the hexadecimal value &h10000. We\u2019ll need this constant when we reconfigure the account so that its password never expires.<\/P>\n
After defining the constant we connect to the Ken Myer user account in Active Directory. Because Ken has a CN equal to Ken Myer<\/I> and because his account is in the Finance OU of Fabrikam.com the code required to connect to that account looks like this:<\/P>
Set objUser = GetObject(“LDAP:\/\/cn=Ken Myer, ou=Finance, dc=fabrikam, dc=com”)\n<\/PRE>\n
Now it starts to get a little weird (but just a little). As it turns out, the Active Directory property that determines whether or not a password expires is contained within the userAccountControl<\/B> property. The userAccountControl property is a \u201cbitmask\u201d property: that means it\u2019s a single property that contains multiple values. Is that important? You bet it is: because userAccountControl contains multiple values we can\u2019t simply set it to, say, True or False. Instead, we need to use \u201cbitwise logic\u201d to toggle the particular property that controls password expiration. That\u2019s just a heads-up to explain why some of the code you\u2019re about to see will look a little unusual, to say the least.<\/P>\n\n<\/THEAD>\n\n\n
\n
Note<\/B>. We won\u2019t to explain bitwise logic in any detail today; for more information, see this section<\/B><\/A> of the Microsoft Windows 2000 Scripting Guide<\/I>.<\/P><\/TD><\/TR><\/TBODY><\/TABLE>\n
<\/DIV>\n
Our next step is to determine whether or not the account already has<\/I> a password that doesn\u2019t expire; after all, if Ken already has a non-expiring password then we don\u2019t need to do anything, do we? Using our bitwise logic we employ this line of code to determine if the \u201cpassword doesn\u2019t expire\u201d property (represented by the constant ADS_UF_DONT_EXPIRE_PASSWD) is not<\/I> enabled (notice the syntax If Not<\/B>):<\/P>
If Not objUser.userAccountControl AND ADS_UF_DONT_EXPIRE_PASSWD Then\n<\/PRE>\n
Like we said earlier, the userAccountControl property is actually composed of a number of different property values; for the time being, think of them as being like switches on a control panel. All we\u2019re doing here is checking to see if the password expires switch (again, represented by the constant ADS_UF_DONT_EXPIRE_PASSWD) is on. If it is, then we\u2019re done. If it\u2019s not, then we need to turn it on. Bitwise logic is confusing, especially at first glance. But, at least in this case, the basic idea is simple: we take an individual switch (property) and either turn it on (enable it) or turn it off (disable it).<\/P>\n
And that\u2019s exactly what we do with the next two lines of code. In the first line we use the Put<\/B> method to change the value of the userAccountControl in the local cache. (What\u2019s this local cache business all about? If you aren\u2019t sure, see this Scripting Puzzle<\/B><\/A> answer for details.) Notice that we need to pass the Put method two parameters:<\/P>\n\n\n\n\n
\u2022<\/TD>\n\n
userAccountControl<\/B>, the property we want to modify.<\/P><\/TD><\/TR>\n
\u2022<\/TD>\n\n
objUser.userAccountControl XOR ADS_UF_DONT_EXPIRE_PASSWD<\/B>, bitwise code for “toggling” the current value of the \u201cpassword doesn\u2019t expire\u201d property. Essentially what we\u2019re saying here is this: if the switch (property) represented by the constant ADS_UF_DONT_EXPIRE_PASSWD is on then turn it off; if it\u2019s off then turn it on. This is easy to do, because the XOR operator simply toggles bitwise values on and off. That\u2019s why we had to make sure that Ken Myer\u2019s account currently did not<\/I> have a password that never expires. If he already had a non-expiring password XOR would toggle that value, thus giving him a password that did<\/I> expire.<\/P><\/TD><\/TR><\/TBODY><\/TABLE>\n
See? Every now and then we do<\/I> have a reason for doing whatever it is we do.<\/P>\n
In the next line we call the SetInfo<\/B> method to write the changes back to Active Directory. And with that, we\u2019re done.<\/P>\n
Of course, a lot of people might be more interested in going the other route; that is, taking an account where the password never expires and configuring it so that the password does<\/I> expire. Here\u2019s a script that does just that, checking to see if the \u201cpassword never expires\u201d property has been enabled and, if so, disables it (again, using XOR to simply toggle the value):<\/P>
Const ADS_UF_DONT_EXPIRE_PASSWD = &h10000<\/p>\n
Set objUser = GetObject(“LDAP:\/\/cn=Ken Myer, ou=Finance, dc=fabrikam, dc=com”)<\/p>\n
intUserAccountControl = objUser.Get(“userAccountControl”)<\/p>\n
If objUser.userAccountControl AND ADS_UF_DONT_EXPIRE_PASSWD Then\n    objUser.Put “userAccountControl”, _\n        objUser.userAccountControl XOR ADS_UF_DONT_EXPIRE_PASSWD\n    objUser.SetInfo\nEnd If\n<\/PRE>\n
So what do you say, BB: is that enough to get your vote that Catch-22<\/I> is one of the four greatest novels ever written? We\u2019ll take that as a \u201cyes.\u201d<\/P>\n\n<\/THEAD>\n\n\n
\n
Note<\/B>. In case you\u2019re wondering, the other three books on the list are \u2013 as everyone knows \u2013 Sometimes a Great Notion<\/I>; Night of the Hunter<\/I>; and The Old Man and the Sea<\/I>. And, yes, we would put Green Eggs and Ham<\/I> on there, too, except we don\u2019t think it\u2019s officially classified as a novel. But it\u2019s a pretty good book nonetheless.<\/P><\/TD><\/TR><\/TBODY><\/TABLE><\/p>\n","protected":false},"excerpt":{"rendered":"
Hey, Scripting Guy! How can I configure an Active Directory user account so that the account password never expires?— BB Hey, BB. Before we start we have a question for you: wouldn\u2019t you agree that Catch-22 is one of the four greatest novels ever written? We ask that because, in his English class, the Scripting […]<\/p>\n","protected":false},"author":595,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[7,9,3,4,20,5],"class_list":["post-66143","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-active-directory","tag-adsi","tag-scripting-guy","tag-scripting-techniques","tag-user-accounts","tag-vbscript"],"acf":[],"blog_post_summary":"
Hey, Scripting Guy! How can I configure an Active Directory user account so that the account password never expires?— BB Hey, BB. Before we start we have a question for you: wouldn\u2019t you agree that Catch-22 is one of the four greatest novels ever written? We ask that because, in his English class, the Scripting […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/66143","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=66143"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/66143\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=66143"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=66143"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=66143"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}