How to track users accounts with Password never expires

As a security best practice it is recommended that users on a network create complex passwords and also change them periodically. Active Directory's password policies help administrators impose such password complexity requirements. With these complexity requirements in place, if a password is never set to expire, then administrators should analyze the reason behind it as it could be an incident.

'Password never expires' events are a threat because:

• It could potentially mean an admin account has been compromised by an outsider or a malicious insider and they are making risky changes, such as changing the security settings, on the network.

• Secondly, user accounts with passwords set to never expire is a low-hanging fruit for a brute force attacker, who has a much better chance at cracking the password as it never expires.

With native AD capability, the auditing of users with 'Password never expires', can be done by enabling Audit Policy and analyzing the generated logs using Windows Event Viewer.

Once the Audit Policy is in place, the Event Viewer records changes to the user account with a unique event ID, which can be inspected to find any users whose passwords settings were modified to 'Password never expires'. The administrator will have to go through all the logs on user account changes to find the ones in question.

Once the Audit Policy is in place, the Event Viewer records changes to the user account with a unique event ID, which can be inspected to find any users whose passwords settings were modified to 'Password never expires'. The administrator will have to go through all the logs on user account changes to find the ones in question.

This article compares the process of finding users with 'Password never expires' set in using native Active Directory tools and techniques and using ADAudit Plus. In both the cases, you need to enable auditing.

Free, fully functional 30-day trial