Read Maximum Password Age with PowerShell

I needed to read out the Maximum Password age with a PowerShell script in a Windows 2003 domain.

Reading out the maxPwdAge attribute is a trivial task  in PowerShell (I am re-using the function AdsLargeIntegerToInt64):

$domain =  New-Object System.DirectoryServices.DirectoryEntry

# Read maxPwdAge attribute and convert to Int64
$maxPwdAge = AdsLargeIntegerToIn64 $Domain.maxPwdAge.Value

In my case this returns the value -78624000000000 but how do we interpret this?

The value is expressed in 100 nanosecond units which is the same unit as a windows FILETIME structure uses.

Knowing that we can use the FromTicks method from the .NET TimeSpan structure to convert it to the number of days:

$maxPwdDays = [System.TimeSpan]::FromTicks([System.Math]::ABS($maxPwdAge)).Days

And $maxPwdDays is 91 in my case.

Note that I am using ABS to make the value positive since maxPwdAge is always negative.