Opselith
POWERSHELL / ACTIVEDIRECTORY
ProIntermediateRead-onlylow

Find AD passwords set to never expire

Find enabled Active Directory user accounts with PasswordNeverExpires set and export the review list to CSV with PowerShell.

Open in PowerShell Builder →Browse all scripts

Pro generation after license validation · Review before running · Opselith does not connect to your tenant

What this PowerShell script does

Finds enabled user accounts with PasswordNeverExpires enabled

Requirements

    Environment

    • Module: ActiveDirectory
    • Permissions: Directory read access
    • Output: CSV report
    • Context: Windows host with RSAT
    • Risk: Low
    Review before you run The full Pro script is generated by Opselith after license validation. Test outside production first.
    NEXT STEP

    Ready to generate

    Configure Find AD passwords set to never expire in the Builder, review the generated PowerShell and run it yourself in your own PowerShell session.

    Configure this script →Open Builder
    More about this script

    Why use this template?

    Use this Pro PowerShell script when you need to find enabled user accounts with passwordneverexpires enabled. It can be previewed in the Builder; Pro access is required to generate it for your own environment.

    The template uses ActiveDirectory and requires Directory read access. Output: CSV report. Level: Intermediate. Action: Read-only. Risk: Low.

    Review before running

    The script remains preview-only until Pro access is enabled. Review it before running it, and test it outside production first. “Read-only” describes the script itself; anything you add around it can still change data.

    Preview the script

    1. Open the template in the PowerShell Builder.
    2. Review the purpose, requirements, permissions, output and risk.
    3. Activate Pro when you are ready to generate the full script, then test it outside production.

    Pro templates remain previewable before purchase or activation. No tenant connection is required. When you generate a Pro script, only the configuration values needed for that template are sent to Opselith after license validation.Preview Find AD passwords set to never expire →

    How to use this result

    Use this report to find enabled Active Directory users whose PasswordNeverExpires account flag is currently set.

    When this helps

    • Review password-expiration exceptions during an identity or security hygiene check.
    • Create a CSV of enabled accounts that are excluded from normal password expiration.
    • Compare exceptions with approved service-account or break-glass documentation.

    How to read the result

    • Each result is an enabled user where Active Directory reports PasswordNeverExpires as true.
    • The flag tells you the configured account setting; it does not prove that the exception is unsafe or unnecessary in your environment.

    Things to check

    • Service accounts and other controlled identities can have documented reasons for different password handling. Review the owner and authentication design before changing anything.
    • This script is read-only. Removing PasswordNeverExpires can affect sign-in behavior and should be handled through a separate approved change process.

    What to do next: Match each exception to an owner and documented reason, then review your domain password policy before planning any account changes.

    Related tasks

    Official references

    Before you runModule, permissions, inputs, compatibility and script checks
    OPS / SCRIPT DETAILS

    Script details

    Finds enabled user accounts with PasswordNeverExpires enabled Review these details before generating or running the script.

    securityfinduserspermissionspassword
    Generated here. Run by you.Opselith does not connect to your tenant or run PowerShell. After generating, review the script and run it in your own PowerShell session.

    What it works with

    Module: ActiveDirectory

    ActiveDirectory lets PowerShell work with on-premises Active Directory and is normally installed through Windows RSAT.

    Context: Windows host with RSAT

    Compatibility: Windows PowerShell 5.1 / ISE is supported for this Active Directory template.

    Permissions and changes

    Permissions: Directory read access

    Risk: Low

    Read-only: designed to collect information without intentionally changing the target environment.

    Changes: Read-only. The script reads data and does not intentionally change the target environment.

    Inputs

    • CSV output path - Example: C:\Temp\report.csv (Required)

    What to expect

    Output: CSV report

    Expect a CSV file at the path you choose. Open it in Excel or another CSV viewer and review the rows.

    Example: C:\Temp\report.csv

    This template is in the Pro library. Generating the full script requires eligible Pro or tester access. Opselith receives only the values needed to build the script; it does not connect to your tenant, run PowerShell or store the generated script. You review and run the result in your own PowerShell session.

    Example use

    Finds enabled user accounts with PasswordNeverExpires enabled

    Enter the required values in the Builder, review the generated script and confirm the output before running it.

    Before you run: Make sure your account has Directory read access. Check that the ActiveDirectory PowerShell module is available and that you are using the supported PowerShell version. Review the generated script and output path, then test outside production first.
    Script checksWhat has been verifiedQA reviewed
    Static checksPassed
    PSScriptAnalyzerPending
    Real-world run testNot yet recorded
    Last checkedNot yet recorded

    Real-world run results are shown only after Opselith reviews and accepts a tester report.

    Tester: report a result →
    TEST STATUSWhat Opselith has checked

    Last reviewed: 10 Sept 2026

    PSScriptAnalyzer: Awaiting a release PSScriptAnalyzer gate that includes this script. No analyzer pass is claimed yet.

    Pending or Not yet recorded means there is no accepted result on file yet. A passed analyzer check does not mean the script has been run in a real tenant.

    NEXT IN THE LIBRARY

    Scripts for similar admin tasks and Microsoft services.

    Browse Active Directory PowerShell scripts →
    POWERSHELLFind AD passwords expiring soonsecurity · find · usersPOWERSHELLFind AD users with expired passwordssecurity · find · usersPOWERSHELLFind AD users with no recorded logon datesecurity · find · users