Import-Module ActiveDirectory
$u = Get-ADUser 'a.vallejo' -Properties MemberOf, Enabled, PasswordLastSet, LockedOut, PasswordExpired
Write-Output "Enabled: $($u.Enabled)  LockedOut: $($u.LockedOut)  PwExpired: $($u.PasswordExpired)"
Write-Output "PwLastSet: $($u.PasswordLastSet)"
Write-Output "UPN: $($u.UserPrincipalName)"
Write-Output "Groups:"
$u.MemberOf | ForEach-Object { Write-Output "  $_" }
# Check if ChangePasswordAtLogon is set (would block login)
$raw = Get-ADUser 'a.vallejo' -Properties pwdLastSet
if ($raw.pwdLastSet -eq 0) { Write-Output "WARNING: ChangePasswordAtLogon=TRUE (pwdLastSet=0)" }
# Validate credential against DC
Add-Type -AssemblyName System.DirectoryServices.AccountManagement
$ctx = New-Object System.DirectoryServices.AccountManagement.PrincipalContext([System.DirectoryServices.AccountManagement.ContextType]::Domain, "cascades.local")
$valid = $ctx.ValidateCredentials("a.vallejo", "Sunrise4827")
Write-Output "Password validates: $valid"