Frequently, administrators suggest changing the Windows account password periodically, but this can occasionally have adverse effects on the local network. In such situations, administrators might want to identify if any user with the necessary privileges modified the account password, along with the precise timing of the change, and whether any account login issues are associated with password expiration.
It is not difficult to perform such a check; for this, a basic level of knowledge of the command line or PowerShell is enough. Let’s start with the classic console command.
Find who and when changed the Windows account password
- Type cmd in the Windows Search, select command prompt from the results, and select Run as administrator.
open command prompt - In the command prompt, type
net user <username>, replacing the <username> with the actual user account name. - In the output, look for the “Password last set” and “Password changeable” lines. They contain the date and time of the last password change.
Time when password changed for user account
That is all.
It is a good idea to check the parameter “User may change password“. If “No” is specified , this user is not related to changing his password.
If the computer is in a domain network, you need to add the /domain switch to the end of the command , like this:
net user <username> /domain
To determine the domain name, use the command:
echo %userdomain%
Finding the data with PowerShell
You can also use a special PowerShell cmdlet to get the date and time when an account’s password was last changed. But it only works on domain networks.
Also, if you’re not running a server version of Windows , you’ll first need to install the Rsar module by running the command in PowerShell.
Add-WindowsCapability –online –Name “Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0”
After installing the module, to get the date of the last password change, execute the command:
Get-ADUser –Identity username -Properties passwordlastset
Where username is the user name you are interested in.
Or:
Get-ADUser -Filter * -Properties PasswordLastSet | ft Name,SamAccountName,PasswordLastSet
If you want to display information about all users in Active Directory .
The date and time you are interested in will be indicated in the “PasswordLastSet” line .
