Set User Password to never expire

[nuhi]

Will investigate and report back, the template should work, or be adapted.

 

[nuhi]

Tested the Template for password expiry (net accounts /maxpwage:unlimited).
Works fine, net accounts returns Maximum password age: Unlimited

Also doing net user <username> returns for a user created during setup Passwords expire: Never

So that UI checkbox is bugged, confirmed it's not checked, nothing to worry about and it does ring a bell.
If anyone sees differently, let me know how.
Note that Post-setup command must execute, there are 3 modes to do so, SetupComplete mode can be skipped on OEM machines.

 

[abbodi86]

I use this in setupcomplete.cmd and the UI checkbox get checked

FOR /F "TOKENS=2 DELIMS==" %%A IN ('"WMIC /NAMESPACE:\\ROOT\CIMV2 PATH Win32_UserAccount GET Name /VALUE"') DO (
CALL WMIC /NAMESPACE:\\ROOT\CIMV2 PATH Win32_UserAccount WHERE Name='%%A' SET PasswordExpires=FALSE
)

powershell equivalent since wmic is threatened

powershell -ep bypass -nop -c "Set-CimInstance -Query 'Select * from Win32_UserAccount' -Property @{PasswordExpires=0}"

 

[BadHellie]

I just wanted to briefly add, that you can also leave the password blank to remove it entirely. I mention this, because it's not intuitive during the Windows Setup process, when the password screen comes up it's worded in a way that sounds like you must enter a password, but if you click next it'll skip it.

I've seen a lot of people asking about the password expiration setting, so I figured at least some of those people are wanting no password, but are assuming it's not possible and so they ask for no expiration instead.

For example I would be one of those. Unfortunately I have always been forced to use a password, otherwise file sharing between different machines in my network won't (apparently) work (ok this might even be a good thing in theory...)

 

[garlin]

For example I would be one of those. Unfortunately I have always been forced to use a password, otherwise file sharing between different machines in my network won't (apparently) work (ok this might even be a good thing in theory...)

Though it's not generally advised, some users will disable SMB password auth and allow anonymous logons.

 

[BadHellie]

net accounts /maxpwage:unlimited DOES NOT WORK here, not even if invoked live from the command prompt.
As a fact, if you open lusrmgr.msc you will see that "Password never expires" remains UNCHECKED.
The proper command seems rather (I found it googling):
wmic UserAccount set PasswordExpires=False
I have added it in PostSetup, post-logon (with >NIL to avoid a shell opening) and on boot with lusrmgr.msc I can see the "Password never expires" box correctly *checked* (this at least with Win 10 22H2)

 

[BadHellie]

Though it's not generally advised, some users will disable SMB password auth and allow anonymous logons.

Indeed, I prefer to keep this minimal security level, at the cost of having to insert a password at every boot

 

[nuhi]

net accounts /maxpwage:unlimited DOES NOT WORK here, not even if invoked live from the command prompt.
As a fact, if you open lusrmgr.msc you will see that "Password never expires" remains UNCHECKED.
The proper command seems rather (I found it googling):
wmic UserAccount set PasswordExpires=False
I have added it in PostSetup, post-logon (with >NIL to avoid a shell opening) and on boot with lusrmgr.msc I can see the "Password never expires" box correctly *checked* (this at least with Win 10 22H2)

Have you tried the command:
net user <username>
it returns Passwords expire: Never for net accounts /maxpwage:unlimited

Since they are removing WMIC in the 24H2, I think it's better to keep as is.
I know that UI checkbox is not updated, as stated above.

Will consider abbodi86's Powershell version for those not removing it.

 

[garlin]

You don't need "-ep bypass" when executing a single command line.

powershell -nop -C "Set-CimInstance -Query 'Select * from Win32_UserAccount' -Property @{PasswordExpires=0}"

 

[xShARkx]

Hello,

I got a few questions...

I am running both of these commands to prevent password expiration on post-setup and after first logon:

Is it fine to run both? Or it's not recommended? Is it a best practice to run them before or after logon?

First I was just running the "net accounts /maxpwage:unlimited" command alone in after logon on post-setup, but in one windows installation right after it finished, it showed me the screen saying that the password for the user had expired and asked me to set a new one.

PS: I am auto-creating the user in Unattended in ntlite without a password, like this:

 

[garlin]

This problem is based on a wrong order of task execution. (Before logon) tasks are obviously run before your first desktop logon.

When unattended mode creates a new user account, an entry is added to the Security Account Manager (SAM) database. This is the same thing as running "net user [logon] [password] /add". Whatever password policy is in effect at the time, is applied to those users.

(After logon) tasks are executed after you have passed the Logon screen. So your changes will be applied on the next logon.

Therefore, the built-in template for "Disable user password expiration" runs "net accounts /maxpwage:unlimited" in (Before logon).

 

[francis11]

In Unattended repeat user name (USER) in Display name and say OK.
When back in UnAttended screen in NTL just click the field Username and it'll be autofilled:


and you'll have 9999999 logon counts:

Should be sufficient for most.