I'm looking for a way to change the default Active Directory password expiration prompt at login from 30 days to our current IT policy of 14 days.

Every time a user logs in on a Mac with Active Directory, they get a 30 day notice, but on a PC they get a 14 day notice, so I know it's something local to the Mac and not something controlled through the servers.

I cannot for the life of me find the .plist that controls this and all other information I can find is extremely out of date.

Any advice?

  • Mac users are more trustworthy ? :)
    – Ruskes
    Feb 18, 2015 at 1:02
  • The Group Policy configuration for Mac users is obviously different than that for Windows users, and this config is on the AD server side. You'll have to ask your Window's sys admins to make the change.
    – IconDaemon
    Feb 18, 2015 at 1:38

1 Answer 1


From Apple AD Integration Guide:

Best Practices for Integrating OS X with Active Directory

Login Window Password Expiration Interval
An administrator can change the default expiration notification for the Login Window from the command line:
defaults write /Library/Preferences/com.apple.loginwindow.plist PasswordExpirationDays -int <number of days>

defaults write /Library/Preferences/com.apple.loginwindow.plist PasswordExpirationDays -int 14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .