title: How can I query users with an expired password in Active Directory?
body: <p>I need to query Active Directory for a list of users whose password is about to expire.  The obvious (and easy) way to do this is with:</p>
  
  <pre><code>dsquery user -stalepwd n 
  </code></pre>
  
  <p>The problem is that I need to add additional filters to only look for users who are in certain security groups.  This is hard to do with the "dsquery user" syntax that has the built-in -stalepwd option, so I've been using the "dsquery * -filter" option which allows you to use LDAP query syntax.  Unfortunately, while its relatively easy to do apply the other filters with an LDAP query, I'm having trouble filtering users who have a password age greater than n.</p>
  
  <p>Does anyone know the syntax (or if it is even possible) to filter for old passwords using the "dsquery * -filter" method instead of the "dsquery user -stalepwd" method.</p>