Today, I had a user txt me because he was out in the field and his password had expired on his Active Directory user account.
We do not have a method for them to reset it from off-site (yet).
So I needed to extend the expiration date on his password so he could use it until he can get in to update his password.
The best solution I could find was to set the pwdLastSet attribute on his Active Directory account to today’s date.
Step 1: Advanced Features
From Active Directory Users & Computers, ensure Advanced Features are enabled on the View menu
Step 2: Attribute Editor
Navigate to the Users account. You should find an Attribute Editor tab.
Step 3: pwdLastSet field 0
Scroll to the pwdLastSet field. Modify it by entering 0 (zero) in the value field. Click OK.
This sets the value to (Never) as in the password has never been set. 设置为0时，表明从未修改过密码；
Click OK on the User Account Properties box.
Step 4: pwdLastSet field -1
Open the User’s Account Properties again. Go back to the Attribute Editor tab.
Scroll to pwdLastSet and modify it with a value of -1. 设置为-1时，把修改密码时间设置为当天；
Click OK twice.
Step 5: View the pwdLastSet value
When you view the pwdLastSet value, it will now indicate today’s date.
While this is not the best solution because it extends the password expiration from today’s date based on our Domain Password Policy instead of just setting it to expire in a few days time.
It is better then setting then leaving it set to Never Expire and end up forgetting to change it back!