Setting an Active Directory User Account to Expire at a Specific Time of Day with PowerShell

Notice that in Active Directory Users and Computers (ADUC) when setting the expiration of a user account, there’s only a way to have the account expire at the end of a specific day:


The same option exists in the Active Directory Administrative Center (ADAC):


In ADAC, you can see the PowerShell command that the GUI uses to accomplish this task:


Let’s query that particular property with PowerShell to see exactly what it’s now set to:


Notice in the previous results, that there’s not only a date, but a time as well.

Using PowerShell, I’ll set the AccountExpirationDate to the specific date and time when I want the account to expire:


Now I’ll double check the value of what that particular property is set to again:


One thing I noticed is that once the date and time set for the account to expire was reached, the user was prevented from logging into a pc, but it took a while before they were prevented from logging into Outlook Web Access. Just something to keep in mind 🙂

What if you change your mind after setting this value and want to set it so the account doesn’t expire? Since I originally set this property using the GUI I don’t know what the default value was. I’ll take a look at another account to see what it’s set to:


So it needs to be set to nothing. I’ll try setting it to $null to see if that works:


Looks like that worked:


Note: The examples shown in this blog article require the Remote Server Administration Tools (RSAT) to be installed on the workstation these commands are being run from (specifically, the Active Directory PowerShell module). The workstation these examples were run from has PowerShell version 4 installed so the module auto-loading feature that was introduced in PowerShell version 3 loaded the Active Directory module and there was no need to explicitly import the Active Directory PowerShell module.




  1. Gamini

    Hi Mike,

    I need to set the expiry date for 100 users, please suggest me something.

    Thank you.

  2. doo doo

    If you have a list than you can use IMPORT-CSV and pipe that into a LOOP and create a header in the csv file like $_.user and it will run though the list. Maybe this will help someone
    import-csv C:\csvfile.csv | foreach-object {Set-ADAccountExpiration -Identity $_.user -DateTime ’12/10/2013 17:00:00′}

    if you want to loop though an ou than, try using Get-ADUser -Filter * -SearchBase “OU=Finance,OU=UserAccounts,DC=FABRIKAM,DC=COM”……….. instead of import-csv

  3. Johnny_Utah

    Hi Mike, is there a good way to use this but only have the users disabled for a period of time, say just a week?


  4. Bernadine Grauer

    Hi Mike,
    Is there a way to add 90 days to multiple users in a csv with different expiration dates?

    • ir0c

      Hi Bernadine,

      I’d say if you had those dates in the correct format in the CSV file, you can pipe the expiration data into the PS script, too.

  5. Justwannasettime Expirationonauser

    AWESOME. Yet another powershell example that doesn’t first explain what to do to actually make the “solution” work for someone. The term ‘Get-ADUser’ is not recognized as the name of a cmdlet, function, script file, or operable program

  6. Justwannasettime Expirationonauser

    Oh, and now I realize you put the prerequisites at the END of your how-to. Interesting.

    • YouShouldTake IntroToPowerShell

      If you didn’t know that you needed to load the AD module in order to run an AD cmdlet, you probably shouldn’t be performing AD related tasks

  7. Michael Berna

    Thanks, this is quite good. I didn’t know about the ADAC powershell window. I like reverse engineering stuff like this.

  8. Paul

    Hi, how do you find out who set an account to expired? Thanks,

  9. Travis Johnson

    ever see where the user and group admin tool saves account expire 1 day more than what was actually selected? Powershell shows the right date, but not the user tool. For example, we set an account to November 6th. In powershell we are seeing November 7th 1:00am. Thoughts?

  10. Chan

    @doo doo Even though this post is very old, but it still works. Thanks!

  11. Chris

    I used this and it shows correctly in Powershell, but Aduc now shows the expiration for yesterday, not today when I have it scheduled for 5 PM. Can I trust the Powershell output or do I trust ADUC and the account is expired if I do.

  12. JJ

    Works like a charm, great info.


Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: