Password Never Expires and Account Set to Expire

Recently I was asked, “What type of user account changes do you watch for?”  There are several but I wanted to focus on 2 changes that most people ask for.  1 “How can I tell if someone’s password has been set to never expire?” and 2nd “How can I tell if an account has been set to expire?”.  We will look at both the Windows 2003 and older Windows OS event (id 642) and the Windows 2008/Vista event (id 4738).  Sure there are scripts that you can run against your AD and Local System accounts to gather this information.  But if you have the correct auditing turned on (Audit Account Mgmt) you can get this information via the event logs and if you are collecting your logs using a log management tool you can get this info in real time.  I’m not going to show the entire event descriptions for id’s 642 and 4738, but I will show the sections that are important to us.  What’s nice about both of these events is that they appear whenever an account has been changed; this can be at the time of account creation or after an account is created.

For id 642 you need to look at the following:

                Target Account Name:   joe.user                  (User whose account was changed)

                Target Domain: Acme                                    (Users domain ; can also indicate local account)

                Caller User Name:   bob.admin                  (Admin who made the change)

               

For id 4738 look at the following:

                Subject:

                                Account Name:  bob.admin         (Admin who made the change)

                Target Account:

                                Account Name:  joe.user              (User whose account was changed)

                                Account Domain:  Acme               (Users domain; can also indicate local account)

 

This information holds true for any change to the account either local or one that is part of your AD.  The next information will tell you What changed on the account.  So for question 1, password set to never expire you need to watch for the following.

For id 642 and 4738:

                Changed Attributes:

                                User Account Control:

                                                ‘Don’t Expire Password’ – Enabled           (Box has been checked for password to never expire)

 

Now when you reverse the change and uncheck the password never expires box you will see ‘Don’t Expire Password’ – Disabled

 

Now for question 2, determine when an account has been set to expire.

For id 642 and 4738:

                Changed Attributes:

                                Account Expires:              x/xx/xxxx  xx:xx:xx PM                 (This gives you the Date/Time that the account will expire)

If an account is setup to never expire then the Account Expires will have a dash (-) after it.