!!! Overview
[{$pagename}] [Virtual Attribute] [Attribute] indicates the time in [LargeInteger Date] format when the [password] of the entry will expire. [1]
[{$pagename}] performs the [AD Determining Password Expiration] calculations.
In [Microsoft Active Directory] [Virtual Attribute] can be returned as value data in an LDAP [SearchRequest].
%%information
The msDS-UserPasswordExpiryTimeComputed attribute exists on AD DS but not on AD LDS.
%%
If USER is the Entry on which the attribute msDS-UserPasswordExpiryTimeComputed is read.
If USER is not in a domain NC, then USER:msDS-UserPasswordExpiryTimeComputed = null.
If DC is the root of the domain NC containing USER. The DC applies the following rules, in the order specified below, to determine the value of USER:msDS-UserPasswordExpiryTimeComputed:
If any of the following are set bits is set on USER entry:[User-Account-Control Attribute]:
* ADS_UF_[SMARTCARD_REQUIRED]
* ADS_UF_[DONT_EXPIRE_PASSWORD]
* ADS_UF_[WORKSTATION_TRUST_ACCOUNT]
* ADS_UF_[SERVER_TRUST_ACCOUNT]
* ADS_UF_[INTERDOMAIN_TRUST_ACCOUNT]
then USER:msDS-UserPasswordExpiryTimeComputed = [0x7FFFFFFFFFFFFFFF|9,223,372,036,854,775,807].
!! If [pwdLastSet] = null or [pwdLastSet] = 0,
then USER:msDS-UserPasswordExpiryTimeComputed = 0.
!! if Effective-MaximumPasswordAge = 0x8000000000000000
then USER:msDS-UserPasswordExpiryTimeComputed = [0x7FFFFFFFFFFFFFFF|9,223,372,036,854,775,807] (where Effective-MaximumPasswordAge is defined in [MS-SAMR] section 3.1.1.5).
!! Otherwise
* msDS-UserPasswordExpiryTimeComputed = USER:[pwdLastSet] + Effective-MaximumPasswordAge (where Effective-MaximumPasswordAge is defined in [MS-SAMR] section 3.1.1.5).
!! More Information
There might be more information for this subject on one of the following:
[{ReferringPagesPlugin before='*' after='\n' }]
----
* [#1] - [MSDN-msDS-UserPasswordExpiryTimeComputed|http://msdn.microsoft.com/en-us/library/cc223410.aspx/|target='_blank'] - based on information observed on 2014-08-11