Powershell: trying to find enabled users with no expired passwords

user_19315719 0
Viewed 52

In Powershell, I'm trying to list all Active Directory user accounts that are enabled and their passwords have not expired.

I get the same results whether I select 'True' or 'False' in the below commands:

Search for False:

get-aduser -filter * -properties * -ResultSetSize 10 | where { $_.PasswordExpired -eq "False" } | select-object displayname, emailaddress, passwordexpired | Sort-Object displayname


|displayname|emailaddress|passwordexpired|
|-----------|------------|---------------|
|user1||True|
|user2|user1@somedomain.com|True|
|user3|user2@somedomain.com|True|
|user4|user3@somedomain.com|True|
|user5|user4@somedomain.com|True|

Search for True:

get-aduser -filter * -properties * -ResultSetSize 10 | where { $_.PasswordExpired -eq "True" } | select-object displayname, emailaddress, passwordexpired | Sort-Object displayname


|displayname|emailaddress|passwordexpired|
|-----------|------------|---------------|
|user1||True|
|user2|user1@somedomain.com|True|
|user3|user2@somedomain.com|True|
|user4|user3@somedomain.com|True|
|user5|user4@somedomain.com|True|

Another variation I tried:

get-aduser -filter { enabled -eq $true } -properties * -resultsetsize 10 | where {$_.PasswordExpired -eq "False"} | select-object displayname, emailaddress, passwordexpired | Sort-Object displayname


|displayname|emailaddress|passwordexpired|
|-----------|------------|---------------|
|user1||True|
|user2|user1@somedomain.com|True|
|user3|user2@somedomain.com|True|
|user4|user3@somedomain.com|True|
|user5|user4@somedomain.com|True|

How do I get a list of enabled users that do not have expired passwords?

powershell active-directory
1 Answers

In PowerShell, any string that is not empty ([string]::Empty or '') evaluates to $true, it's also worth noting that this happens because the boolean is in the LHS (left-hand side) of your comparison, hence PowerShell attempts type coercion on the RHS to match the same type as the LHS:

$true -eq 'False' # => True
[bool] 'False'    # => True
'False' -eq $true # => False

In this case the proper filtering would be:

Get-ADUser -Filter "enabled -eq '$true'" -Properties PasswordExpired |
    Where-Object { -not $_.PasswordExpired } |
        Select-Object -First 10

You can also use this filter instead of -not if you like:

Where-Object { $_.PasswordExpired -eq $false }
user_153395440
Related