Finds enabled users where Active Directory reports PasswordExpired. This keeps AD's own account-state semantics, including password-change-at-next-logon style cases.
Generated securely after server-side Pro license validation · Review before running · Opselith does not connect to your tenant
Finds enabled users where Active Directory reports PasswordExpired. This keeps AD's own account-state semantics, including password-change-at-next-logon style cases.
Configure Find AD users with expired passwords in the Builder, review the generated PowerShell and run it yourself in your own PowerShell session.
Use this PowerShell template when you need to find enabled users whose password is already expired. It can be previewed in the Builder; Pro access is required to generate it for your own environment.
The template uses ActiveDirectory and requires Directory read access. Output: CSV report. Level: Intermediate. Action: Read-only. Risk: Low.
The script remains preview-only until Pro access is enabled. Review it before running it, and test it outside production first. “Read-only” describes the script itself; anything you add around it can still change data.
Pro templates remain previewable before purchase or activation. No tenant connection is required. When you generate a Pro script, only the configuration values needed for that template are sent to Opselith after license validation.Preview Find AD users with expired passwords →
Finds enabled users where Active Directory reports PasswordExpired. This keeps AD's own account-state semantics, including password-change-at-next-logon style cases. Review these details before generating or running the script.
Module: ActiveDirectory
ActiveDirectory lets PowerShell work with on-premises Active Directory and is normally installed through Windows RSAT.
Context: Windows host with RSAT
Compatibility: Windows PowerShell 5.1 / ISE is supported for this Windows administration template.
Permissions: Directory read access
Risk: Low
Read-only: designed to collect information without intentionally changing the target environment.
Changes: Read-only. The script reads data and does not intentionally change the target environment.
Output: CSV report
Expect a CSV file at the path you choose. Open it in Excel or another CSV viewer and review the rows.
Example: C:\Temp\report.csvThis template is in the Pro library. Generating the full script requires eligible Pro or tester access. Opselith receives only the values needed to build the script; it does not connect to your tenant, run PowerShell or store the generated script. You review and run the result in your own PowerShell session.
Finds enabled users where Active Directory reports PasswordExpired. This keeps AD's own account-state semantics, including password-change-at-next-logon style cases.
Enter the required values in the Builder, review the generated script and confirm the output before running it.
Real-world run results are shown only after Opselith reviews and accepts a tester report.
Tester: report a result →Last reviewed: 10 Sept 2026
PSScriptAnalyzer: Awaiting a release PSScriptAnalyzer gate that includes this script. No analyzer pass is claimed yet.
Pending or Not yet recorded means there is no accepted result on file yet. A passed analyzer check does not mean the script has been run in a real tenant.