PowerShell GUI查询AD过期及即将过期用户账户遇问题求助

第一段Get-ADUser代码的语法错误修复 #

你的第一段代码存在两个核心问题：

1. AD过滤器解析失败：单引号包裹的Filter中，PowerShell表达式（如(get-date).AddDays(...)）不会被执行，AD服务会将整段字符串视为无效过滤条件。需先计算密码过期阈值，再代入过滤器；同时布尔值要使用AD可识别的格式。
2. 代码块缺少闭合大括号：if($User.PasswordLastSet...)和外层if($ExpiringPasswords)均未闭合，导致语法报错。

修复后的代码：

$ShowExpiring.Add_Click({
    $ADUserSearch.Visible = $False
    $CheckDisabled.Visible = $False
    $ShowExpiring.Visible = $False
    $Back.Visible = $True
    $Results.Visible = $True
    $Results.Clear()
    $Results.ScrollBars = "Vertical"

    Import-Module ActiveDirectory
    $currentDate = Get-Date
    $maxPasswordAgeDays = (Get-ADDefaultDomainPasswordPolicy).MaxPasswordAge.Days
    $expirationThreshold = $currentDate.AddDays(-$maxPasswordAgeDays)

    # 先计算阈值再构建过滤器
    $ExpiringPasswords = Get-ADUser -Filter "PasswordExpired -eq `$true -or PasswordLastSet -le '$expirationThreshold'" `
        -Properties Name, PasswordLastSet

    if($ExpiringPasswords) {
        $ExpiringPasswords = $ExpiringPasswords | Sort-Object PasswordLastSet
        foreach ($User in $ExpiringPasswords) {
            if ($User.PasswordLastSet -lt $expirationThreshold) {
                $Results.SelectionColor = "Red"
            } else {
                $Results.SelectionColor = "Orange"
            }
            # 若需显示密码过期日期，可替换为：$expirationDate = $User.PasswordLastSet.AddDays($maxPasswordAgeDays)
            $Results.AppendText("Username: $($User.Name)  Password Last Set: $($User.PasswordLastSet)`n")
        }
    } else {
        $Results.AppendText("No passwords expiring or already expired.")
    }
})

第二段Search-ADAccount无法获取禁用用户的修复 #

Search-ADAccount默认排除已禁用账户，需添加-IncludeDisabledAccounts参数才能包含这类用户；同时合并结果时建议去重，避免重复条目。

修复后的代码：

$ShowExpiring.Add_Click({
    $ADUserSearch.Visible = $False
    $CheckDisabled.Visible = $False
    $ShowExpiring.Visible = $False
    $Back.Visible = $True
    $Results.Visible = $True
    $Results.Clear()
    $Results.ScrollBars = "Vertical"

    Import-Module ActiveDirectory
    $CurrentDate = Get-Date

    # 添加-IncludeDisabledAccounts参数获取禁用用户
    $expiredUsers = Search-ADAccount -AccountExpired -UsersOnly -IncludeDisabledAccounts | 
        Select-Object Name, @{n='ExpirationDate';e={[datetime]::FromFileTime($_.AccountExpirationDate)}}
    $expiringUsers = Search-ADAccount -AccountExpiring -TimeSpan (New-TimeSpan -Days 10) -UsersOnly -IncludeDisabledAccounts | 
        Select-Object Name, @{n='ExpirationDate';e={[datetime]::FromFileTime($_.AccountExpirationDate)}}
    
    # 合并结果并去重
    $ExpiringPasswords = ($expiredUsers + $expiringUsers) | Select-Object -Unique | Sort-Object ExpirationDate

    if($ExpiringPasswords) {
        foreach ($User in $ExpiringPasswords) {
            if ($User.ExpirationDate -lt $CurrentDate) {
                $Results.SelectionColor = "Red"
            } else {
                $Results.SelectionColor = "Orange"
            }
            $Results.AppendText("Username: $($User.Name)  Expiration Date: $($User.ExpirationDate)`n")
        }
    } else {
        $Results.AppendText("No passwords expiring or already expired.")
    }
})

注：这段代码查询的是用户账户本身的有效期，若你的需求是查询密码过期，需调整为密码相关的过滤逻辑。

内容的提问来源于stack exchange，提问作者Juli199696