Alerting when an account is set to not expire

We had a requirement to alert when an account was created in AD with the “Password will not expire” flag on and when an existing account is changed to a password that will not expire for audit purposes.

It can be done using the following alert generating rule:

Expire1

Expire2

 

The reason for the %%2089 is that events on the domain controller are generated using codes which are then converted to English in the event viewer. Something to bear in mind when creating rules to look at DC event logs.

Note: This event is for AD 2008 only.

Leave a Reply

Your email address will not be published. Required fields are marked *