Hey Charles--can you further specify your question? When you say "when someone change and AD have an expiration date", what are you specifically asking? Is this referring to someone changing a password? Is this when the "ExpirationDate" attribute on the account is modified for a particular user?

Expiration Data attribute.  Seem like we have someone changing Expiration Date attribute on account and we are not aware of change until it was too late?

 

 

That sounds more like something your SIEM or some other AD reporting tool would alert on.