Determining the Expiration of AD Domain Passwords

Q: How can I find out the date and time a user's Active Directory (AD) domain password expires?

A: You might think this excellent question has a simple answer. However, several factors add to the question's complexity. To get the answer, you need to ask several questions:

1. Does the user's password expire? If not, you don't need to calculate an expiration date.
2. What is the domain's maximum password age? That is, how long can a password be used before it expires? If the domain doesn't specify a maximum password age, you don't need to calculate an expiration date.
3. At what date and time was the user's password last set? If the password hasn't been set, you can't calculate an expiration date.

I'll present each of these questions as a subtask, then I'll give you a script that lets you calculate and display a user's password expiration date. These subtasks are presented here in VBScript, but I also wrote JScript versions that you can download from the Windows Scripting Solutions Web site at http://www.windowsitpro.com/ windowsscripting, InstantDoc ID 94256. I wrote the final script in JScript for reasons I'll explain shortly. . . .