Kerberos Database Auditing/Querying

[John Devitofranceschi]

Are there any tools that would allow someone to generate reports from the KDC (or the local principal file) which answer questions like:

Which principals are expired?

Which principals have expired passwords?

Which principals have passwords that will expire in N days?

Which principals have policy "xyzzy"?

You get the idea...

Any pointers or pointers to pointers appreciated!

jd