Determine the maximum password age in Active Directory

Question

I want to expire users' passwords on an individual basis in Microsoft Active directory at different times.

I understand that each user within AD does not have it's own password expry time. Instead there is a Maximum Password Age associated with the domain, and a LastPasswordSet date associated with the user.

I intend to set the LastPasswordSet to simulate the behavior of each user having an individual max password age.

In order to do this, I need to know the Maximum Password Age associated with the domain. How to I determine this programmatically from .NET?

Edit: I see that LastPasswordSet is readonly, so my approach may have no merit.

Answer 1

If you use ADSI it's the property maxPwdAge. Here's an article that includes a sample of getting this out:

http://msdn.microsoft.com/en-us/library/ms974598.aspx