Get-ADPasswordInfo

Get-ADuser -Identity JohnSmith -Properties * | Select-Object *

Get-ADuser -Identity JohnSmith -Properties Displayname,Passwordlastset,Badpasswordtime,msDS-userpasswordexpirytimecomputed,lockedout,accountlockouttime,LastBadPasswordAttempt

Get-ADuser -Identity JohnSmith -Properties Displayname,Passwordlastset,Badpasswordtime,msDS-userpasswordexpirytimecomputed,lockedout,accountlockouttime,LastBadPasswordAttempt | Select-Object @{Name="ExpiryDate";Expression={[datetime]::fromfiletime($_."msds-userpasswordexpirytimecomputed")}}

$GetADUserArgs = [ordered]@{
    Identity = $User
    Server = $Server
    Properties = @(
        'Displayname',
        'Passwordlastset',
        'Badpasswordtime',
        'msDS-userpasswordexpirytimecomputed',
        'lockedout',
        'accountlockouttime',
        'LastBadPasswordAttempt')
}

$SelObjArgs = [ordered]@{
    Property = @("Displayname",
                "Passwordlastset",
                @{Name="ExpiryDate";Expression={[datetime]::fromfiletime($_."msds-userpasswordexpirytimecomputed")}},
                "Lockedout",
                @{Name="LockoutTime";Expression={ $_.accountlockouttime }},
                @{Name="LastFailedAuth";Expression={ $_.lastbadpasswordattempt}}
    )
}

Get-ADUser @GetADUserArgs | Select-Object  @SelObjArgs

Function Get-ADPasswordInfo {
    Param(
    [cmdletbinding()]
    [Parameter(Position = 0, ValueFromPipeline,Mandatory=$true)]
    [Alias('Username')]
    $User,
    [string]$Server = 'contoso.com' #put your AD domain here

)

Begin {
    # stuff to set up before processing the request

    # check to make sure the AD module is loaded

    if (!(Get-module -name ActiveDirectory)){
        Import-Module -Name ActiveDirectory
    }
    # define our 'select-object' properties to make the command easier to read down below

    $SelObjArgs = [ordered]@{
        Property = @("Displayname",
                    "Passwordlastset",
                    @{Name="ExpiryDate";Expression={[datetime]::fromfiletime($_."msds-userpasswordexpirytimecomputed")}},
                    "Lockedout",
                    @{Name="LockoutTime";Expression={ $_.accountlockouttime }},
                    @{Name="LastFailedAuth";Expression={ $_.lastbadpasswordattempt}}
        )
    }
    # an array to store our results in

    $results = @()
} # end Begin block


Process {
    # our command parameters, defined ahead of time for easier reading down below. This needs to be in the 'process' block so that the $user variable can be defined/updated from pipelineinput

    $GetADUserArgs = [ordered]@{
        Identity = $User
        Server = $server
        Properties = @('Displayname','Passwordlastset','Badpasswordtime','msDS-userpasswordexpirytimecomputed','lockedout','accountlockouttime','LastBadPasswordAttempt')
    }
    # do the query and then append the info to the results array

    Try{
        $adinfo = Get-ADUser @GetADUserArgs -ErrorAction SilentlyContinue | Select-Object  @SelObjArgs
    }Catch [Microsoft.ActiveDirectory.Management.ADIdentityNotFoundException]{
        Write-Host "$User not found in domain: $Server" -ForegroundColor Yellow
    }Catch{
        $Error[0].Exception
    }
    $results+=$adinfo
} # end Process block


End {
    $Results | Format-Table
} # end of End block

} # end of function

Get-ADPasswordInfo -User cbodett
Displayname            Passwordlastset      ExpiryDate           Lockedout LockoutTime LastFailedAuth
-----------            ---------------      ----------           --------- ----------- --------------
Bodett, Courtney        2/13/2020 3:44:03 PM 4/13/2020 4:44:03 PM     False             3/16/2020 7:16:02 AM

Search-ADaccount -Lockedout | Select-Object -Expand samaccountname | Get-ADPasswordInfo