samba - May 2023 - samba-tool : how to remove expiry date of an account

On 24/05/2023 10:56, Olivier BILHAUT via samba wrote:
> Hi list :)
> 
> I am looking for the right command to achieve my goal.
> 
> I
> would like to remove the account expiry date of an ACCOUNT with a
> samba-tool command (account never expires)
> 
> Options of "samba-tool user
> setexpiry" are :
> --filter=FILTER LDAP Filter to set password
> on
> --days=DAYS Days to expiry
> --noexpiry
> 
> Unfortunately, the "noexpiry"
> parameter just set another option which is "the PASSWORD never
expires"
> which is related to the passord, and so serve a totally different goal.
Only in the commands help.

It doesn't touch the password, it alters the 'userAccountControl'
and
'accountExpires' attributes, the latter is to '0' (i.e. never)
in the
case of no expiry.

Rowland

Hi Rowland, and many thanks for fast reply, 

When using --noexpiry,
the userAccountControl is set to 66048, which disable expiry for
password as well (in MS console, "password never expires" is now
checked). 

This means that the password expiry (let say, every 6 month)
will never popup again to the user, which is in my sense a wrong
behaviour. 

Is there a way to change ONLY "accountExpires" attribute
without changing "userAccountControl" ? 

Otherwise : is there another
value for "userAccountControl" that does not disable the password
expiry
in the same time ? 

Thanks,

--OB

Le 2023-05-24 12:30, Rowland Penny
via samba a ?crit :
> On 24/05/2023 10:56, Olivier BILHAUT via samba
wrote:
>> Hi list :)
>> 
>> I am looking for the right command to
achieve my goal.
>> 
>> I
>> would like to remove the account expiry
date of an ACCOUNT with a
>> samba-tool command (account never
expires)
>> 
>> Options of "samba-tool user
>> setexpiry" are :
>>
--filter=FILTER LDAP Filter to set password
>> on
>> --days=DAYS Days to
expiry
>> --noexpiry
>> 
>> Unfortunately, the "noexpiry"
>> parameter
just set another option which is "the PASSWORD never
expires"
>> which
is related to the passord, and so serve a totally different
goal.
> 
>
Only in the commands help.
> 
> It doesn't touch the password, it alters
the 'userAccountControl' and 
> 'accountExpires' attributes, the latter
is to '0' (i.e. never) in the 
> case of no expiry.
> 
> Rowland