Stephen Berg, Code 7309 via FreeIPA-users wrote:
Is there any method to use ipa-epn to get a report on already
expired
passwords? I tried using negative numbers in the to-nbdays and
from-nbdays but it doesn't allow that. I've got some accounts that are
still active but due to the broad expansion of teleworking they haven't
been used much and now have expired passwords.
There is no way in the tool to do it. If you want to open an issue
https://pagure.io/freeipa/new_issue with your request we can take a look.
If you're familiar with LDAP you can probably run the tool for current
users then tweak the query it sends to match your needs as a manual
workaround.
rob