Hmm... interesting, but, that's for the PW ... not for the account itself. Wouldn't you be able to have "password never expires" for an account that is set to expire on dec 31?

Sorry, I didn't read that correctly. Does the date have to be reset or can it simply be a date far into the future?

Has to be completely blank, no expiry date at all.

I suppose I could set it to the year 3030 or something but they want it well and truly blank.

‌  ‌  ‌  ‌  ‌  ‌


HAAAAAAAAAAAALP! Haha. (Please!)

Set the "accountExpires" property to 9223372036854775807

Ah yes in the year 30828! 

I wonder how this displays in Active Directory? Does it appear as blank?

I'm now reading this: 

AD accounts that have been set up to never expire are expiring 

I went into AD and set the Account Expires to a date next year.

Then used Update AD User and set the accountExpires to that number. When I looked at the user in AD, it was set to "Never expires".

AMAZING!

My hero, yet again, is the infamous ‌

I thank you, sir.

Now that the problem has been solved... Now I want to know why.

In all seriousness the concept, especially from a security perspective, of an account expiry is sound. So why would you want an account to never expire? My guess would be for a service account or something of that nature or for testing purposes. But, since I'm just as curious as a cat, would you mind sharing?  

Glad I could be of service Rhia

Funny you should mention that, because when you were hired, we set your account to expire Nov 24th 2017.

Does anyone really set the accountExpires?  It makes sense if you hire people on contract or if you have an employee who gives notice.  But if you hire FTE's, at the beginning, surely you wouldn't set that field to anything other than Never expires.

I guess in Rhia's situation, it could be that you hired a contractor who had an end date for his contract, and midstream, they were converted to an FTE.

Vadim 

Well oddly enough, having a domain admin account and a workflow, I've remedied that situation.  

Having spent some time in corporate IT (and infrastructure specifically) this is something that was very important to consider. Our temporary contract workers had 6 month expiration on their AD accounts.

But, less anyone's AD OU's fill up with tons of old accounts, expiration is a good policy to enable in group policy and the SAMexpirationdate could be updated for say another 12 months (or more) after a performance review, open enrollment, etc. 

Every 12 months... you mean like with a scheduled workflow that controls Performance Reviews?

Precisely!  

My client hires a LOT of consultants, so expiry dates are a requirement for them. And all of their FTE have no expiry date.

Right now, a process is that if the employee gives a resignation, the workflow will set their AD to expire the day after their departure. However, if they change their mind mid-leave, and decide to stay (oh, you'll give me a $60k raise? Sure, I'll stay!) we then need to clear that expiry.

That's the need, here, and what drove this.

Consultants. Makes perfect sense. Being a stickler, I'd probably still put some sort of expiry on those FTE accounts too...

Thanks for sharing ‌!

Rhia Wieclawek wrote:

However, if they change their mind mid-leave, and decide to stay (oh, you'll give me a $60k raise? Sure, I'll stay!)

Who's your client???? 

This kind of conversation and sharing made me smile. It is as if I'm sitting in front of you hearing you guys conversing. Thanks for bringing this up too ‌.