How to get or set the AccountExpires attribute

This not as easy as one might think. the active Directory is not storing dates as a normal [datetime],it use a special a 64bit interger call an IADsLargeInterger.

This mean that you can’t simply use a $user.accountExpires property to get or set the value, this will return a System.__ComObject

To get the AccountExpires property the easiest way (I think), is to use the DirectorySearcher [ADSISearcher] . This will not return a normal DirectoryEntry but a SearchResult data type. The difference is that the accountExpires property is return as an int64 instead of a IADsLargeInterger (don’t ask me why). An int64 is much easier to handle, here’s how to do it :

$search = [ADSISearcher] "" 
$search.Filter = "(cn=testUser)" 
$user = $search.FindOne()  
[datetime]::fromfiletime($user.properties.accountexpires[0])

Of course you can’t set the  AccoutExpires with a SearchResult data type. But you can use a special invokeSet on a DirectoryEntry that seems to convert a [datetime] to the correct format :

$user=[adsi]"LDAP://cn=testUser,dc=mycompany,dc=com"
$newAccountExpires=(Get-Date).addMonths(1)
$User.InvokeSet("AccountExpirationDate",$newAccountExpires)

You can also try to use an InvokeGet("AccountExpirationDate") method on a DirectoryEntry but it will throw an error if the AccountExpires attribute is not set (E_FAIL).

Update october 28th, 2013

With Powershell 2.0 and greater you can use the ConvertLargeIntegerToInt64 method :

$user=[adsi]"LDAP://cn=testUser,dc=mycompany,dc=com"
[datetime]::fromfiletime($user.ConvertLargeIntegerToInt64($user.properties.lastlogon[0]))