Is there a an easy way from the command line (or even just a setting to check somewhere) to see when a password for a local Windows account (specifically Server 2K3) expires or when it was last changed?
Assuming that we're talking about a local account on Windows Server, and not an Active Directory Domain user. Then open cmd.exe and enter the following command:
NET USER username
You'll get a dump of information about the account including the password last set information.
If you want to make it fancier and get back just that information you can pipe the output of net user to the find command:
NET USER username | find "Password last set"
Note for Active Directory accounts: If you're more interested in a domain account you can add the /domain switch to check for the same information. However, due to the distributed nature of AD you may not get the most accurate time from the DC you're asking. The most precise time is stored in the pwd-last-set attribute of the user account, but that requires some manipulation to make sense.
C:\Documents and Settings\adam>net user adam
User name adam
Full Name Your Momma
Comment
User's comment
Country code 000 (System Default)
Account active Yes
Account expires Never
Password last set 7/1/2009 10:32 AM
Password expires Never
Password changeable 7/1/2009 10:32 AM
Password required Yes
User may change password No
Workstations allowed All
Logon script
User profile
Home directory
Last logon 8/19/2009 3:24 PM
Logon hours allowed All
Local Group Memberships *Administrators *Debugger Users
*Users
Global Group memberships *None
The command completed successfully.
Use the "net user" command - for example "net user USERNAME" will display a list with all sorts of info, including password last set and password expiration.
Assuming that we're talking about a local account on Windows Server, and not an Active Directory Domain user. Then open cmd.exe and enter the following command:
You'll get a dump of information about the account including the password last set information.
If you want to make it fancier and get back just that information you can pipe the output of net user to the find command:
Note for Active Directory accounts: If you're more interested in a domain account you can add the /domain switch to check for the same information. However, due to the distributed nature of AD you may not get the most accurate time from the DC you're asking. The most precise time is stored in the pwd-last-set attribute of the user account, but that requires some manipulation to make sense.
The 'net user' command line will do just that:
Use the "net user" command - for example "net user USERNAME" will display a list with all sorts of info, including password last set and password expiration.
NET USER username /domain | find "Password last set"
Just change the username to your actual "user name". The /domain is just that.