How is is possible to create a managed unit or query that shows all users who have Password Never Expires (edsaPasswordNeverExpires) set to TRUE?
Active Directory stores this setting as a userAccountControl bitwise hash. This can be queried using the following LDAP string:
NOTE: The :1.2.840.1135220.127.116.113: is a special LDAP OID which is also known as LDAP_MATCHING_RULE_BIT_AND
For more information on the userAccountControl attribute, see this Microsoft resource.
To turn this query into a Managed Unit: