How to find the date and time the password was changed by an user on Windows Server 2008 Active Directory

To get the date and time of when the password was changed for a particular account, open powershell and run the following commands:

$getdata=New-Object DirectoryServices.DirectorySearcher

$getdata.Filter="(&(samaccountname=<useraccount>))"

(write useraccount without the <> brackets, example JohnDoe)

$results=$getdata.findone()

[datetime]::fromfiletime($results.properties.pwdlastset[0])

 

This will output the date and time when the password was changed