List Last Windows Password Change For All Users On A Non-Domain System

问题

I have found an answer to this question for systems that are attached to an AD domain controller. However, this question is for standalone systems where there is no possibility of attaching to a domain controller. Essentially, air-gapped systems.

Short and sweet: Is there a way to list the last time each user changed their Windows password for a non-domain, air-gapped system (either Windows 7 or 10) all at once either as a batch file or PowerShell script?

I know that net user {username} | find /I "Password last set" will do it for them one at a time. However, that would be tedious to run multiple times per machine and we have over 60 systems of this type. So I'm looking for a way to do this in one fell swoop, if possible.

As a caveat, we don't have the option of installing the activedirectory module in PowerShell for this. Also, since the majority of the systems are Windows 7, we don't have access to the Bash command line tools that would be available in Windows 10.

Any and all help with regard to this is appreciated.

回答1:

Here's one way using the ADSI WinNT provider:

$computerName = [Net.Dns]::GetHostName()  # i.e., local computer
$computer = [ADSI] "WinNT://$computerName,Computer"
$childObjects = $computer.Children
foreach ( $childObject in $childObjects ) {
  if ( $childObject.Class -eq "User" ) {
    if ( $childObject.PasswordAge[0] -gt 0 ) {
      $pwdLastSet = (Get-Date).AddSeconds(-$childObject.PasswordAge[0])
    }
    else {
      $pwdLastSet = $null
    }
    $childObject | Select-Object `
      @{Name="AdsPath";         Expression={$_.AdsPath}},
      @{Name="PasswordLastSet"; Expression={$pwdLastSet}}
  }
}

来源：https://stackoverflow.com/questions/46571762/list-last-windows-password-change-for-all-users-on-a-non-domain-system