{"id":69073,"date":"2005-08-29T15:21:00","date_gmt":"2005-08-29T15:21:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2005\/08\/29\/how-can-i-get-a-list-of-all-the-users-whose-passwords-never-expire\/"},"modified":"2005-08-29T15:21:00","modified_gmt":"2005-08-29T15:21:00","slug":"how-can-i-get-a-list-of-all-the-users-whose-passwords-never-expire","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/how-can-i-get-a-list-of-all-the-users-whose-passwords-never-expire\/","title":{"rendered":"How Can I Get a List of All the Users Whose Passwords Never Expire?"},"content":{"rendered":"

\"Hey, \n

Hey, Scripting Guy! How can I get a list of all the users whose passwords never expire?

— NW<\/P>\"Spacer\"\"Hey,\"Script<\/A> \n

Hey, NW. As you probably know, Internet gambling is illegal in the USA. That\u2019s too bad, because if it wasn\u2019t we\u2019d be willing to bet $10 that the answer to your question will be this: search Active Directory.<\/P>\n

And as much as we hate to say \u201cWe told you so,\u201d well, guess what:<\/P>

On Error Resume Next<\/p>\n
Set objConnection = CreateObject(“ADODB.Connection”)\nSet objCommand =   CreateObject(“ADODB.Command”)\nobjConnection.Provider = “ADsDSOObject”\nobjConnection.Open “Active Directory Provider”\nSet objCommand.ActiveConnection = objConnection<\/p>\n
objCommand.Properties(“Page Size”) = 1000<\/p>\n
objCommand.CommandText = _\n    “<LDAP:\/\/dc=fabrikam,dc=com>;” & _\n        “(&(objectCategory=User)(userAccountControl:1.2.840.113556.1.4.803:=65536));” & _\n            “Name;Subtree”\nSet objRecordSet = objCommand.Execute<\/p>\n
objRecordSet.MoveFirst\nDo Until objRecordSet.EOF\n    Wscript.Echo objRecordSet.Fields(“Name”).Value\n    objRecordSet.MoveNext\nLoop\n<\/PRE>\n
You\u2019re right: we should have bet way more than $10. What were we thinking<\/I>?<\/P>\n
Actually, it\u2019s just as well that we didn\u2019t bet on this. The truth is, we cheated: we had some inside information. After all, any time you\u2019re looking for Active Directory-related stuff the answer is going to be the same: search Active Directory. We knew the answer long before you even asked the question.<\/P>\n
What we didn\u2019t<\/I> know, at least in this case, was how to actually conduct our search. We won\u2019t talk too much about the details of writing scripts that search Active Directory; that background information can be found in our two-part Tales from the Script<\/I> article Dude, Where\u2019s My Printer?<\/B><\/A> However, we will take a minute of two to talk about the query we ended up using in order to conduct the search, a query that might look a bit different from the Active Directory queries you\u2019re used to working with: <\/P>
objCommand.CommandText = _\n    “<LDAP:\/\/dc=fabrikam,dc=com>;” & _\n        “(&(objectCategory=User)(userAccountControl:1.2.840.113556.1.4.803:=65536));” & _\n            “Name;Subtree”\n<\/PRE>\n
If you\u2019re thinking, \u201cWhoa, that doesn\u2019t look like a SQL query to me,\u201d well, there\u2019s a good reason for that: this isn\u2019t<\/I> a SQL query. Instead, this is an example of the LDAP query syntax, a query syntax that can retrieve the same information as a SQL query, albeit in a much more cryptic fashion.<\/P>\n
But if that\u2019s the case, then why did we decide to use this weird-looking syntax rather than the more familiar (and more comfortable) SQL query syntax? Well, as it turns out, the property that determines whether or not a password expires (ADS_UF_DONT_EXPIRE_PASSWD) is not a \u201cstand-alone\u201d property; that is, you can\u2019t get at the value using code similar to this:<\/P>
Wscript.Echo objUser.ADS_UF_DONT_EXPIRE_PASSWD\n<\/PRE>\n
Instead, this value is one of several \u201cflags\u201d found in the userAccountControl<\/B> attribute. The userAccountControl attribute is an example of a bitmask attribute, a single attribute that houses multiple property values; this single attribute tells you whether or not a password will expire, whether or not a password has<\/I> expired, whether or not an account is disabled, etc. In this case, if the flag with the value 65536 is switched \u201con,\u201d then the password never expires; if the flag is switched off, then the password does<\/I> expire.<\/P>\n\n<\/THEAD>\n\n\n
\n
Note<\/B>. Yes, we know: many of you have no idea what we just said. For a brief introduction to bitmasks you might take a look at this section<\/B><\/A> of the Microsoft Windows 2000 Scripting Guide<\/I>.<\/P><\/TD><\/TR><\/TBODY><\/TABLE>\n
<\/DIV>\n
So what difference does that make to us? Well, it makes a big difference: you can\u2019t (or at least can\u2019t easily) use a SQL query to search for a single value inside a bitmask attribute. You can<\/I> do this using the LDAP query syntax, however, so that\u2019s what we did. Like the cars driven by a couple of the Scripting Guys, it\u2019s a bit ugly, but it works just fine. (Sorry, guys, but the truth hurts.)<\/P>\n
As for the query itself, we\u2019ll briefly explain what the individual pieces do, to give you some idea of how the whole thing works. Thus:<\/P>\n\n<\/THEAD>\n\n\n\n\n\n\n\n\n
\n
Item<\/B><\/P><\/TD>\n
\n
Description<\/B><\/P><\/TD><\/TR>\n
\n
<LDAP:\/\/dc=fabrikam,dc=com><\/P><\/TD>\n
\n
The starting point for the search. We want to search all of Active Directory, so that means starting in the root (i.e., fabrikam.com).<\/P><\/TD><\/TR>\n
\n
&<\/P><\/TD>\n
\n
Equivalent to the AND operator in a SQL query. We need this because we\u2019re searching for users and<\/I> we\u2019re searching for a specific value in the userAccountControl attribute. Both of these criteria must be met for an object to be returned.<\/P><\/TD><\/TR>\n
\n
(objectCategory=User)<\/P><\/TD>\n
\n
Limits the returned data to user accounts.<\/P><\/TD><\/TR>\n
\n
(userAccountControl:1.2.840.113556.1.4.803:=65536)<\/P><\/TD>\n
\n
Indicates that we want to return only those accounts where the userAccounControl flag for 65536 is switched on; that equates to user accounts where the password doesn\u2019t expire. We\u2019ll explain this werid-looking block of code in a little more detail down below.<\/P><\/TD><\/TR>\n
\n
Name<\/P><\/TD>\n
\n
The Active Directory attributes we want reported back. We\u2019re asking to get back only a single attribute: Name<\/B>. To report back additional attributes just tack them on to the end of Name, separating each one using commas:<\/P>
Name,cn,AdsPath\n<\/PRE><\/TD><\/TR>\n
\n
Subtree<\/P><\/TD>\n
\n
Indicates the type of search. Specifying Subtree<\/B> causes the script to search all the OUs and containers found in the root of fabrikam.com. Because all the OUs and containers have<\/I> to be found in the root this causes the script to search all of Active Directory.<\/P><\/TD><\/TR><\/TBODY><\/TABLE>\n
<\/DIV>\n
As odd as this might look, most of it actually makes sense: once you know what the individual parts represent, it isn\u2019t too hard to read (or even to modify) an LDAP query. Well, OK, with one exception:<\/P>
(userAccountControl:1.2.840.113556.1.4.803:=65536)\n<\/PRE>\n
Yes, we know how weird it looks and, yes, we wish some of the werindess had been hidden from view. But, setting looks aside, this is really pretty simple stuff. The 1.2.840.113556.1.4.803<\/B> is nothing more than an example of an LDAP matching rule object identifier (OID); in turn, this is just a somewhat-clunky way of saying: \u201cShow me all the objects where the userAccountControl flag with the value 65536 is on.\u201d That\u2019s really all there is to it. That also means that you can search for other attribute values found in userAccountControl<\/B><\/A> simply by substituting the desired value for 65536. Need a list of all the disabled accounts? Here you go:<\/P>
(userAccountControl:1.2.840.113556.1.4.803:=2)\n<\/PRE>\n
Cool.<\/P>\n
And yes, we know your next question: can you modify our original query to find all the users who don\u2019t<\/I> have non-expiring passwords? Sure, although the syntax is, again, a bit odd-looking. Without bothering to explain it all, here\u2019s modified code that searches for user accounts where the password does<\/I> expire:<\/P>
(!(userAccountControl:1.2.840.113556.1.4.803:=65536))\n<\/PRE>\n
In this case, the !<\/B> indicates \u201cdoes not equal.\u201d Bet you 10 bucks that you didn\u2019t know that<\/I>, did you?<\/P>\n
Oh. Well, OK then, just let us know where the send the check. This is not<\/I> going to look good on our expense account. (Or at least it wouldn\u2019t if any of us actually had<\/I> an expense account.)<\/P><\/p>\n","protected":false},"excerpt":{"rendered":"
Hey, Scripting Guy! How can I get a list of all the users whose passwords never expire?— NW Hey, NW. As you probably know, Internet gambling is illegal in the USA. That\u2019s too bad, because if it wasn\u2019t we\u2019d be willing to bet $10 that the answer to your question will be this: search Active […]<\/p>\n","protected":false},"author":595,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[7,3,20,5],"class_list":["post-69073","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-active-directory","tag-scripting-guy","tag-user-accounts","tag-vbscript"],"acf":[],"blog_post_summary":"
Hey, Scripting Guy! How can I get a list of all the users whose passwords never expire?— NW Hey, NW. As you probably know, Internet gambling is illegal in the USA. That\u2019s too bad, because if it wasn\u2019t we\u2019d be willing to bet $10 that the answer to your question will be this: search Active […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/69073","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=69073"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/69073\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=69073"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=69073"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=69073"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}