When analyzing users under SAM\Domains\Account\Users, the account expiration date is found in offset 32-39.
The value 7FFFFFFFFFFFFFFF or 0 will mean that the account never expires (ref https://msdn.microsoft.com/en-us/library/ms675098(v=vs.85).aspx).

In Fred, the value 7FFFFFFFFFFFFFFF is interpreted as 1975/01/22 22:55:33

I can provide a SAM file for testing if you like.

• Log in or register to post comments

Thx for the report. I've added it to my bugtracker: https://code.pinguin.lu/T36