Script to disable password expiry for local Windows accounts

Posted on Friday 10 September 2004Monday 21 May 2007 By Mark Wilson

This content is 20 years old. I don't routinely update old blog posts as they are only intended to represent a view at a particular point in time. Please be warned that the information here may be out of date.

One of the shortcomings of the net user command in Windows is the inability to set the password never expires flag on an account (account expiry options can be set, but not password expiry and the full syntax is described in Microsoft knowledge base article 251394).

There are 13 flags on an NT SAM/Active Directory user account which may be manipulated using VBScript (for further details of the 13 flags, see Microsoft’s sample scripts or there is some useful information about the object model at the Motobit Software website).

This script can be used to set the password never expires flag on a specified account. I’ve tested it against the local SAM database on a Windows XP PC, but in theory it should work on all versions of Windows NT (2000, XP, 2003 Server, etc.) and also against Active Directory accounts if you run it on a domain controller.

11 thoughts on “Script to disable password expiry for local Windows accounts”

Jonny says:

Wednesday 20 July 2005 at 3:59

Wow, this really saved my day – or rather my night.

It took me hours of experimenting and nothing helped. And finally I find this…
Anonymous says:

Wednesday 23 November 2005 at 16:17

The domain option can be set to %computername% to make the script a touch more dynamic. Example: cscript “Desktop\nopwdexp.vbs” /domain:%comput
ername% /user:florist
Tom says:

Thursday 14 September 2006 at 11:48

Great, I’ve been looking for this for years! Thanks a lot!
Mark Spanner says:

Thursday 19 April 2007 at 16:38

Thank you for the script – works a treat & saved me some effort.
Cheers.
Mark Bishop says:

Sunday 29 April 2007 at 20:51

The script is excellent. There is an alternative for those who can’t/won’t use this script and are running Windows 2003. Just type:

wmic useraccount where name=”user_name” set PasswordExpires=FALSE

In a command prompt. WMIC is included on every Windows 2003 version AFAIK.

(my 2 Maltese cents for as long as they’re worth something)
Mark Wilson says:

Sunday 29 April 2007 at 22:38

I’m glad it came in useful guys and thanks Mark (Bishop) for the WMIC tip.

Mark
Aaron says:

Tuesday 10 July 2007 at 14:15

I found the answer to setting the password to never expire, thanks to Mark Bishop, using the WMIC.
Ilja says:

Monday 16 July 2007 at 9:30

Thanks. This VB-script really helped me out.
Marty Caise says:

Thursday 2 April 2009 at 20:58

Thanks for the script it really helped me pull someone who managed the servers out of the gasoline fire :)
Adam says:

Thursday 24 September 2009 at 20:53

Thanks Mark! That saved me LOTS of time :)
Venkat says:

Tuesday 17 May 2011 at 8:46

Wov, this has saved me hell a lot of time
Thanks a lot Mark