How can I enumerate domain users with 'Password Never Expires' set from inside the domain using PowerShell or PowerView?

Question

Onedaysec · Accepted Answer

From inside the domain, you can use the `ActiveDirectory` module with commands like `Search-ADAccount -PasswordNeverExpires | FT Name`, or `Get-ADUser -filter * -properties Name, PasswordNeverExpires | where {$_.passwordNeverExpires -eq "true"}`. With PowerView, import the module and filter users via `Get-NetUser` and a bitwise AND check: `if(($User.useraccountcontrol -band 65536) -eq 65536)`. These methods are essential for identifying weak accounts during domain attacks, similar to techniques used in [Domain Penetration - AS-REPRoasting](/news/domain-penetration-as-reproasting).