samba - May 2023 - samba-tool : how to remove expiry date of an account

Hi Rowland, and many thanks for fast reply, 

When using --noexpiry,
the userAccountControl is set to 66048, which disable expiry for
password as well (in MS console, "password never expires" is now
checked). 

This means that the password expiry (let say, every 6 month)
will never popup again to the user, which is in my sense a wrong
behaviour. 

Is there a way to change ONLY "accountExpires" attribute
without changing "userAccountControl" ? 

Otherwise : is there another
value for "userAccountControl" that does not disable the password
expiry
in the same time ? 

Thanks,

--OB

Le 2023-05-24 12:30, Rowland Penny
via samba a ?crit :
> On 24/05/2023 10:56, Olivier BILHAUT via samba
wrote:
>> Hi list :)
>> 
>> I am looking for the right command to
achieve my goal.
>> 
>> I
>> would like to remove the account expiry
date of an ACCOUNT with a
>> samba-tool command (account never
expires)
>> 
>> Options of "samba-tool user
>> setexpiry" are :
>>
--filter=FILTER LDAP Filter to set password
>> on
>> --days=DAYS Days to
expiry
>> --noexpiry
>> 
>> Unfortunately, the "noexpiry"
>> parameter
just set another option which is "the PASSWORD never
expires"
>> which
is related to the passord, and so serve a totally different
goal.
> 
>
Only in the commands help.
> 
> It doesn't touch the password, it alters
the 'userAccountControl' and 
> 'accountExpires' attributes, the latter
is to '0' (i.e. never) in the 
> case of no expiry.
> 
> Rowland

Hi Rowland and list, 

I allow myself to give a UP to my message in
case  someone has an idea. 

Thanks,

--Oliver 

Le 2023-05-24 15:55,
Olivier BILHAUT via samba a ?crit :
> Hi Rowland, and many thanks for
fast reply, 
> 
> When using --noexpiry,
> the userAccountControl is set
to 66048, which disable expiry for
> password as well (in MS console,
"password never expires" is now
> checked). 
> 
> This means that the
password expiry (let say, every 6 month)
> will never popup again to the
user, which is in my sense a wrong
> behaviour. 
> 
> Is there a way to
change ONLY "accountExpires" attribute
> without changing
"userAccountControl" ? 
> 
> Otherwise : is there another
> value for
"userAccountControl" that does not disable the password
expiry
> in the
same time ? 
> 
> Thanks,
> 
> --OB
> 
> Le 2023-05-24 12:30, Rowland
Penny
> via samba a ?crit :
> 
>> On 24/05/2023 10:56, Olivier BILHAUT
via samba
> wrote:
>>> Hi list :)
>>> 
>>> I am looking for the right
command to
> achieve my goal.
>>> 
>>> I
>>> would like to remove the
account expiry
> date of an ACCOUNT with a
>>> samba-tool command
(account never
> expires)
>>> 
>>> Options of "samba-tool user
>>>
setexpiry" are :
>>> 
> --filter=FILTER LDAP Filter to set password
>>>
on
>>> --days=DAYS Days to
> expiry
>>> --noexpiry
>>> 
>>>
Unfortunately, the "noexpiry"
>>> parameter
> just set another option
which is "the PASSWORD never expires"
>>> which
> is related to the
passord, and so serve a totally different goal.
>> 
>> 
> Only in the
commands help.
>> 
>> It doesn't touch the password, it alters
> the
'userAccountControl' and 
>> 'accountExpires' attributes, the latter
>
is to '0' (i.e. never) in the 
>> case of no expiry.
>> 
>> Rowland