question

ErwinvandenBorn-2996 avatar image
0 Votes"
ErwinvandenBorn-2996 asked FanFan-MSFT commented

Powershell - I get difference in output returned

Hi all,

I have been struggling with a Powershell script for expired passwords in my domain. I run the following script as a domain admin :

 get-aduser -filter * -properties passwordlastset, passwordneverexpires |ft Name, passwordlastset, Passwordneverexpires

On my own laptop I get a proper resonse with all the users and the information. 108845-2021-06-24-08h08-55.png


When I run the same script on a Domain Controller, I get different (incomplete) information: 108883-dc.png



Any idea?

Thanks in advance!

windows-server-powershellwindows-active-directory
dc.png (122.2 KiB)
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

FanFan-MSFT avatar image
0 Votes"
FanFan-MSFT answered

Hi,

Welcome to share here!
Did you login with the same user?
Please try to run the PowerShell with administrator and run the script again.
Did you get the same result on all the DCs?

Then check the passwordlastset attribute of the users with blank on DCs.
If possible, please share a screenshot here!

Best Regards,

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

ErwinvandenBorn-2996 avatar image
0 Votes"
ErwinvandenBorn-2996 answered ErwinvandenBorn-2996 commented

Hi, thanks for your reply.

I did not login as the same user as I run Powershell as a different user. The result on both DC's is the same. Running the script on a DC as administratror (so run as admin instead of run as different user with domain admin credentials) does work.

As I want to run this script scheduled on a daily basis, I need to run this under a Service Account that we use for these kind of scheduled tasks.

· 4
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hi,
So, when running the script on all DC as administrator, it shows the correct information.
But when you run as the service account, the information is incomplete), right?
How did you grant the permissions to the account to run the schedule tasks?
Best Regards,

0 Votes 0 ·

yes indeed. The account that can run the tasks is a domain admin account.

0 Votes 0 ·
FanFan-MSFT avatar image FanFan-MSFT ErwinvandenBorn-2996 ·

Is it a member of the administrator group?
Best Regards,

0 Votes 0 ·
Show more comments
ParvezGadhia-1089 avatar image
0 Votes"
ParvezGadhia-1089 answered ErwinvandenBorn-2996 commented

Just give a try using the same command with selecting different DC if you have more than one dc in your environment.

get-aduser -filter * -Server DC01.domain.local -properties passwordlastset, passwordneverexpires |ft Name, passwordlastset, Passwordneverexpires

get-aduser -filter * -Server DC02.domain.local -properties passwordlastset, passwordneverexpires |ft Name, passwordlastset, Passwordneverexpires

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

I got the same result

0 Votes 0 ·
FanFan-MSFT avatar image
0 Votes"
FanFan-MSFT answered FanFan-MSFT commented

Hi,

From my side i will try to:
1, Disable the UAC temporarily
2, When configure the schedule task, select the option:
Run with the highest privileges
Best Regards,

· 4
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hi,

I did disable the UAC. I tested it with the "highest privileges" but have the same result.

So it only works when I login to the DC, start Powershell as administrator and run the script...

0 Votes 0 ·
FanFan-MSFT avatar image FanFan-MSFT ErwinvandenBorn-2996 ·

Hi,
I would do more research about it,
If there are any progress, i would update here!
Best Regards,

0 Votes 0 ·

Thanks. I will keep trying and let you know if I get any results.

0 Votes 0 ·
Show more comments