Question

I am writing an application that communicates with Active Directory and I need to test how it behaves when the password of a user account in Active Directory has only a few days until its expiration date.

Therefore my question is: how can I set the password expiration date of a particular Active Directory user account to a date like “today + 2 days” (without changing the password expiration policy, of course!). I am looking either for manual way to do that or a programmatic solution (e.g. VBScript or C# based).

I have already tried these two approaches:

• Set pwdLastSet using ADSIEdit. Problem: I can change the value only to 0. Other values are rejected with the error code 0x57 (Invalid argument).

• Using IADsUser::PasswordExpirationDate: Problem: setting PasswordExpirationDate fails with error code 0x800A01BD. (See code example below.)

Code example:

strUserName = "test97"
Set objUser = GetObject("LDAP://CN=" & strUserName & ",CN=Users,DC=mydomain,DC=com")
dtmDate = Now+2
objUser.PasswordExpirationDate = dtmDate 
objUser.SetInfo
MsgBox "Successfully changed password expiration date"

Answer 1

This is not possible. You can only mark the password as expired.