Local Account: Find Last Password Change

Question

Is there a an easy way from the command line (or even just a setting to check somewhere) to see when a password for a local Windows account (specifically Server 2K3) expires or when it was last changed?

Answer 1

Assuming that we're talking about a local account on Windows Server, and not an Active Directory Domain user. Then open cmd.exe and enter the following command:

NET USER username

You'll get a dump of information about the account including the password last set information.

If you want to make it fancier and get back just that information you can pipe the output of net user to the find command:

NET USER username | find "Password last set"

Note for Active Directory accounts: If you're more interested in a domain account you can add the /domain switch to check for the same information. However, due to the distributed nature of AD you may not get the most accurate time from the DC you're asking. The most precise time is stored in the pwd-last-set attribute of the user account, but that requires some manipulation to make sense.

Answer 2

The 'net user' command line will do just that:

C:\Documents and Settings\adam>net user adam

User name                    adam
Full Name                    Your Momma
Comment
User's comment
Country code                 000 (System Default)
Account active               Yes
Account expires              Never

Password last set            7/1/2009 10:32 AM
Password expires             Never
Password changeable          7/1/2009 10:32 AM
Password required            Yes
User may change password     No

Workstations allowed         All
Logon script
User profile
Home directory
Last logon                   8/19/2009 3:24 PM

Logon hours allowed          All

Local Group Memberships      *Administrators       *Debugger Users
                             *Users
Global Group memberships     *None
The command completed successfully.

Answer 3

Use the "net user" command - for example "net user USERNAME" will display a list with all sorts of info, including password last set and password expiration.

Answer 4

NET USER username /domain | find "Password last set"

Just change the username to your actual "user name". The /domain is just that.