Using the Active Directory command-line tools, in a Windows 2000 domain, or Windows Server 2003 domain, I have scripted Cantchpwd.bat to list all users in my domain who cannot currently change their password.

NOTE: The Cantchpwd.bat script does NOT report accounts that are disabled.

The syntax for using Cantchpwd.bat is:


The output is displayed on the CMD console, but you can pipe it to a file using the following syntax:


You can use the output in subsequent commands, as in:

for /f "Tokens=*" %%i in ('Cantchpwd') do SomeCommand %%i

NOTE: See How do I list accounts in my domain that have NOT changed their password in nnn days?

NOTE: See How can I report all inactive user accounts, and optionally disable them?

Cantchpwd.bat contains:

@echo off                              setlocal                              if exist "%TEMP%\Cantchpwd.tm1" del /q "%TEMP%\Cantchpwd.tm1"                              if exist "%TEMP%\Cantchpwd.tm2" del /q "%TEMP%\Cantchpwd.tm2"                              set getit=dsquery user domainroot -name * -limit 0                              for /f "Tokens=*" %%u in ('%getit%') do set UDN=%%u&call :pwd                              if not exist "%TEMP%\Cantchpwd.tm1" endlocal&goto :EOF                              sort "%TEMP%\Cantchpwd.tm1" /O "%TEMP%\Cantchpwd.tm2"                              type "%TEMP%\Cantchpwd.tm2"                              del /q "%TEMP%\Cantchpwd.tm1"                              del /q "%TEMP%\Cantchpwd.tm2"                              endlocal                              goto :EOF                              :pwd                              for /f "Skip=1 Tokens=1-2" %%i in ('dsget user %UDN% -canchpwd -disabled') do (                               if /i "%%i" NEQ "dsget" call :report %%i %%j                              )                              goto :EOF                              :report                              if /i "%1" EQU "yes" goto :EOF                              if /i "%2" EQU "yes" goto :EOF                              @echo %UDN%>>"%TEMP%\Cantchpwd.tm1"