Okta retrieves password expiration data only when Just-In-Time (JIT) Provisioning is enabled by reading the msDS-UserPasswordExpiryTimeComputed attribute provided by the Domain Controller that handled the JIT event, which can be found in the AD Agent logs.
Administrators can use PowerShell to retrieve this attribute and convert it into a readable format to troubleshoot password policy behavior, unexpected password change prompts, or Password Expiration Email Automation.
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Active Directory (AD)
- AD-Sourced Users
- Delegated Authentication
- Just-In-Time (JIT)
This 2-minute video describes how to retrieve password expiration data using PowerShell.
How to verify password expiration date using PowerShell?
To retrieve a user's password expiration date using PowerShell, run the command below:
Get-ADUser -server <DC name> -Credential '<oktaservice>' <samaccountname> -Properties "DisplayName", "msDS-UserPasswordExpiryTimeComputed" | Select samaccountname,Displayname,@{Name="PasswordExpirationDate";Expression={[datetime]::FromFileTime($_."msDS-UserPasswordExpiryTimeComputed")}}
- Replace
<samaccountname>with the user identifier. - Replace
<DC name>with the name of the domain controller that processed the JIT authentication. - Replace
<oktaservice>with the samaccountname of the AD Agent service account. - Enter the password of this service account when prompted.
This method uses the Okta AD Agent service account to retrieve user data and verifies that the account has the necessary permissions to access it. If the command returns no result for the attribute, the password never expires.
How to verify password expiration using Command Prompt?
The net user <samaccountname> /domain command queries only the Default Domain Policy. It does not recognize fine-grained password policies or individual user overrides. For organizations using FGPP, the Password expires date may be incorrect. Use the PowerShell method above to ensure technical accuracy.
Follow these steps to verify the password expiration date of a user using Command Prompt:
- Open an administrative Command Prompt.
- Run the following command:
net user <samaccountname> /domain- Replace
<samaccountname>with the specific user. - Locate the Password expires value in the output.
