AD Spoke v2 – Account expiration date showing one day earlier in AD Account tab

[SubaP_1]

Hi Community,

I am using Active Directory Spoke v2 – Update Object Expiration action in ServiceNow to extend the expiration date of an existing AD account.

For example, the requested account expiry date is 29 October 2026.

After executing the action, the values in Active Directory are displayed as follows:

• Attribute Editor → accountExpires: 29 October 2026 12:00:00 AM
• Account tab → Account expires → End of: 28 October 2026

Please refer to the attached screenshots.

Based on the AD behavior, the expected result for an expiry date of 29 October 2026 is:

• Attribute Editor → accountExpires: 30 October 2026 12:00:00 AM
• Account tab → Account expires → End of: 29 October 2026

Could someone please advise on the correct way to implement this using AD Spoke v2?

Specifically:

1. Is Update Object Expiration the correct action to use for extending an existing user's account expiration date?
2. If the requested expiry date is 29 October 2026, should 30 October 2026 be passed to the Update Object Expiration action so that the AD Account tab displays 29 October 2026?
3. Alternatively, is there another AD Spoke v2 action that should be used to update the accountExpires attribute directly?
4. Which AD attribute/value should be updated to ensure the Account expires date displayed in the AD Account tab exactly matches the expiry date requested in ServiceNow?

The requirement is to retain 29 October 2026 as the requested expiry date in ServiceNow and have the AD Account tab also display 29 October 2026.

Any guidance on the recommended approach would be appreciated.

Thanks in advance!

[kmohammed]

Your deduction is correct, and Update Object Expiration is the right action. This is AD behavior, not a spoke bug.

Why it shifts by one day: accountExpires is the instant the account stops being valid, not the last valid day. When accountExpires is 29 October 2026 12:00:00 AM, the account is already expired at the start of 29 October, so AD Users and Computers shows Account expires: End of 28 October 2026.

What to pass: keep 29 October 2026 as the requested date in ServiceNow, but pass requested date + 1 day to Update Object Expiration. For your example, pass 30 October 2026. That sets accountExpires to 30 October 2026 12:00:00 AM, and the Account tab will then show End of 29 October 2026, which is what you want. In Flow Designer, add the day before the spoke action rather than changing the requested date on the record.

On your other questions: you do not need a different action to set accountExpires directly. Update Object Expiration already updates that attribute, and there is no separate AD field behind the Account tab display to set instead. Only update accountExpires, and verify the result on a test account first, since time zone conversion between ServiceNow and AD can shift a midnight value by a day if it is not handled consistently.