How to Find Last Password Change in Active Directory

This guide shows you how to find the last password change date for any user in Active Directory. You’ll learn several methods, from the built-in PowerShell cmdlets to searching with ADUC, and what to do when the attribute appears blank or incorrect. No special tools are required—just standard Windows administrative access.

What You’ll Need

• A Windows machine with the Active Directory PowerShell module (usually available on domain controllers or with RSAT installed).
• An account with read access to user properties (domain users typically have this).
• For ADUC (Active Directory Users and Computers), the Advanced Features option must be enabled to see the attribute editor.

Step-by-Step

Method 1: Using PowerShell (Recommended)

1. Open PowerShell as an administrator. Click Start, type PowerShell, right-click and select Run as administrator.
2. Import the Active Directory module if not already loaded: Import-Module ActiveDirectory (this is automatic on domain controllers).
3. To see the last password change for a single user, run: Get-ADUser -Identity username -Properties PasswordLastSet | Select-Object Name, PasswordLastSet. Replace username with the actual samAccountName (e.g., jsmith).
4. If you need the date in a readable format, use: Get-ADUser jsmith -Properties PasswordLastSet | Format-List Name, PasswordLastSet.
5. To list all users with their last password change, run: Get-ADUser -Filter * -Properties PasswordLastSet | Select-Object SamAccountName, PasswordLastSet | Sort-Object PasswordLastSet.
6. To export to a CSV file: Get-ADUser -Filter * -Properties PasswordLastSet | Select-Object SamAccountName, PasswordLastSet | Export-Csv -Path C:\passwords.csv -NoTypeInformation.

Method 2: Using Active Directory Users and Computers (ADUC)

1. Open Active Directory Users and Computers (dsa.msc). You can do this by pressing Win+R, typing dsa.msc, and pressing Enter.
2. In the left pane, navigate to the domain and the OU containing the user.
3. Right-click the user and select Properties.
4. Go to the Attribute Editor tab. If you don’t see this tab, you must enable Advanced Features first: in the ADUC menu bar, click View and check Advanced Features.
5. Scroll down to find pwdLastSet. The value displayed is a large number (a FILETIME timestamp). This is not human-readable directly.
6. To interpret it, you can use PowerShell: convert the value to a date with [DateTime]::FromFileTime(132456789012345678) (replace the number with the actual value).

Method 3: Using Command Prompt (for quick check)

1. Open Command Prompt as administrator.
2. Run net user username /domain (replace username with the actual user name).
3. Look for the line Password last set—it shows the date and time.

Common Mistakes

• Using the wrong attribute: pwdLastSet is the correct attribute. Sometimes people confuse it with whenChanged or whenCreated, which are different.
• Not enabling Advanced Features: Without this, the Attribute Editor tab does not appear in ADUC.
• Forgetting to specify -Properties: In PowerShell, if you don’t include -Properties PasswordLastSet, the property may not be loaded and will appear as $null.
• Interpreting the FILETIME incorrectly: The raw pwdLastSet value is a 64-bit FILETIME, not a Unix timestamp. Use [DateTime]::FromFileTime() in PowerShell.

Tips

• For a quick check of a single user, the net user command is the fastest, but it only works for domain accounts if you are on a domain-joined machine.
• If you need to audit many users, PowerShell with a CSV export is the most efficient.
• Remember that PasswordLastSet is not updated when an admin resets a password using “Reset Password” in ADUC—it is updated only when the user actually changes their password or when the admin sets a new one (the reset counts as a change).
• If you see a value of 0 or null, it may mean the password was never set (e.g., a user who has never logged on) or the account is disabled.

Troubleshooting

“Get-ADUser is not recognized” – This means the Active Directory module is not installed. Install RSAT (Remote Server Administration Tools) on Windows 10/11, or run the command on a domain controller.

“Access denied” or “Permission denied” – Ensure you have at least read access to user objects. If you are not a domain admin, ask your administrator for the necessary permissions.

The value in ADUC is a huge number – That is normal. Use the PowerShell conversion method to get a readable date.

The date shown seems wrong (e.g., in the future) – Check the system clock on the domain controller. If the DC’s clock is skewed, the FILETIME will be off. Also, ensure you are looking at the correct domain controller—replication delays can cause stale data.

PasswordLastSet is blank for some users – This can happen for accounts that have never had a password set (like computer accounts) or if the attribute is not replicated. Try querying a different DC.

Frequently Asked Questions

Does PasswordLastSet update when a user changes their password?

Yes, it updates automatically when the user changes their password, and also when an admin resets it.

Can I find the last password change for all users at once?

Yes, use the PowerShell command Get-ADUser -Filter * -Properties PasswordLastSet to list all users.

What if I don’t have PowerShell or RSAT?

You can still use net user username /domain from Command Prompt, or use ADUC with Advanced Features enabled.

Is there a way to see password last set without admin rights?

Regular users can view their own password last set using net user %username% /domain (on a domain-joined machine). Viewing other users typically requires at least read access.

Why does the pwdLastSet value show 0 for some accounts?

A value of 0 means the account has never had a password set, which is common for computer accounts or accounts that are disabled before first login.

Does the password last set date include password changes done by the user on a different device?

Yes, as long as the change is processed by the domain controller, the attribute is updated and replicated across the domain.

Related

• How to Tell Someone Snapchat Plus
• How to Edit Direct Messages on X (Twitter)
• GNOME Extensions Manager: Safe Usage Guide