SysFlint AD
Password and Expiry Reporting
Password policy in Active Directory is only as good as the set of accounts that actually obeys it. The exceptions accumulate quietly: PASSWD_NOTREQD set during a migration, "password never expires" ticked for a service account in 2018, an admin account whose password predates the current policy entirely.
How this is normally done
The userAccountControl flags are queryable, and password age is a subtraction:
Get-ADUser -Filter { Enabled -eq $true } `
-Properties PasswordNeverExpires, PasswordNotRequired, PasswordLastSet |
Where-Object { $_.PasswordNeverExpires -or
$_.PasswordNotRequired -or
$_.PasswordLastSet -lt (Get-Date).AddDays(-365) } |
Select-Object Name, SamAccountName, PasswordNeverExpires,
PasswordNotRequired, PasswordLastSetWhere it stops being enough
- Fine-grained password policies mean "older than policy" is not one number across the estate.
- A null PasswordLastSet — an account that has never set a password — needs to be handled separately or it disappears.
- The output tells you the flag is set but not whether it is justified; without ownership context every service account looks like a finding.
- Nobody sees it unless it is scheduled, formatted, and sent.
What SysFlint AD does instead
Every password-policy exception in one report, measured against the policy that actually applies to each account.
- Accounts with "password never expires", broken out by whether they are privileged.
- Accounts flagged as not requiring a password at all — usually a migration artefact, always worth knowing about.
- Password age compared against the fine-grained policy in force for that account, not one global number.
- Accounts that have never set a password since creation.
- Upcoming expiries, so the helpdesk sees them before the calls arrive.
What's in the report
- Password-never-expires accounts, privileged ones listed first
- Password-not-required accounts
- Password age per account against its effective policy
- Accounts with no password ever set
- Expiries falling due in the next 7, 14, and 30 days
Frequently asked questions
- Does it read or crack passwords?
- No. It reads password metadata — the flags on the account and the date the password was last set. It never reads, tests, or exports password material of any kind.
- Does it understand fine-grained password policies?
- Yes. Password age is compared against the policy that actually resolves for each account, so accounts governed by a PSO are not measured against the default domain policy.
- Can it email users before their password expires?
- The scheduled report tells the team which expiries are coming up. Notifying the end user directly is not something a read-only auditing tool should be doing on your behalf.
Related features
Related use cases
Get SysFlint AD
Free, forever. No license keys, no per-user pricing, no seat counts, no trial timer.