First, 544 is not the only value that means the user is not required to have a password. The userAccountControl attribute is an integer where each bit corresponds to a different setting. For example, 546 means the user does not need a password and the account is disabled. 66080 means the user has “Password does not expire” and “password not required” set. 66082 means the same, but in addition the account is disabled. However, 544 will probably be the most common value. Still, to find all users with “password not required” set, you can use the following:
dsquery * -filter "(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=32))" -attr distinguishedName userAccountControlI know the syntax for the filter clause is ugly, but it tests the value with the bit mask 32 (equal to hex 20) to see if the bit is set. The clause will be true if the bit is set, meaning a password is not required.
I find when I create users with a VBScript program, the account will have “password not required” set, unless I either specify a value for userAccountControl, or run code to turn this bit off. It doesn’t happen if I use PowerShell to create the user. It’s easy to happen without realizing it.