Question

Hello! I need help with this problem: Write a script that will let the user turn off the ‘Password never expires” property of all local user accounts that are members of the Administrators local group. You may approach this in two phases – first, do it for all local user accounts, and then for only those in the Administrators group.

I'm having trouble on starting. I've been researching, but I haven't been able to find some solid information on it.

Answer 1

$ADS_UF_DONT_EXPIRE_PASSWD = 0x10000
$admin = [ADSI] "WinNT://$Env:USERDOMAIN/$Env:COMPUTERNAME/Administrator,User"
$flags = $admin.UserFlags[0]
if ( ($flags -band $ADS_UF_DONT_EXPIRE_PASSWD) -ne 0 ) {
  $flags = $flags -band (-bnot $ADS_UF_DONT_EXPIRE_PASSWD)
  $admin.UserFlags = $flags
  $admin.SetInfo()
}

Retrieve UserFlags (bit array), and if the bit is set, clear it. Reassign UserFlags with cleared bit, and write the change.