AD Fun – Find users who can login without password

This can be fun, but don’t expect to find it often:

Get-ADUser -filter {PasswordNotRequired -eq $true} -properties * | select SamAccountName,surname,givenname,LockedOut,PasswordNotRequired,enabled | Format-Table -AutoSize

 

Don’t forgot to check old passwords, too:

Get-ADUser -filter * -properties * | select SamAccountName,surname,givenname,PasswordLastSet,PrimaryGroup,LastLogonDate , LockedOut , logonCount , PasswordNotRequired, BadLogonCount, badPwdCount, Enabled | Format-Table -Property * -autosize | Out-String -Width 4096 | Out-File C:\pw-last-set.txt

For larger lists you may want to replace Out-File with Export-Csv -path C:\pw-last-set.csv