How to retrieve all locked user account from ADAM?
- From: "Matthieu" <MT.microsoftGroup@xxxxxxxxxxx>
- Date: 29 Nov 2005 10:52:15 -0800
Hi,
I try to retrieve all locked user account from an ADAM partition with
an ldifDe command.
I think that the best way is to use one of the constructed attributes
"ms-DS-UserAccountAutoLocked" or "msDS-User-Account-Control-Computed".
Unfortunately, it seems that ADAM does not allow searching with these
attributes:
- The following command :
ldifde -f <outputFile>
-s <myServer>
-d <myUserDn> -r "(objectClass=*)"
-l ms-DS-UserAccountAutoLocked,msDS-User-Account-Control-Computed
retrieve the following output
dn: <myUserDn>
changetype: add
msDS-User-Account-Control-Computed: 528
ms-DS-UserAccountAutoLocked: TRUE
- The following command :
ldifde -f <outputFile>
-s <myServer>
-d <myUserDn>
-r "(ms-DS-UserAccountAutoLocked=TRUE)"
-l ms-DS-UserAccountAutoLocked,msDS-User-Account-Control-Computed
does not retrieve any entry and does not generate error.
- The following command :
ldifde -f <outputFile>
-s <myServer>
-d <myUserDn>
-r "(msDS-User-Account-Control-Computed:1.2.840.113556.1.4.803:=16)"
-l ms-DS-UserAccountAutoLocked,msDS-User-Account-Control-Computed
does not retrieve any entry and does not generate error.
(Command build from the URL [1] and URL [2])
It seems that it is possible to retrieve these attributes but not use
them for searching in ADAM.
With Active Directory, it is possible to use "UserAccountControl"
Attribute.
The only solution to find locked account is to use "lockoutTime"
attribute
(cf URL 3):
- Retrieve "Lockout Duration" from security policy
(practically, it is hard-coded)
- Retrieve current time
- Compute <CurrentTime> - <Lockout-Duration> ( not very simple !)
- Use LDAP Filter "(lockoutTime >= <CurrentTime> -
<Lockout-Duration>)"
.... just quit complex ...
Is it an easier method ?
Thanks in advance,
M. T.
REFERENCES:
[1] : http://forums.asp.net/1064491/ShowPost.aspx
[2] : http://support.microsoft.com/default.aspx?scid=kb;en-us;Q305144
[3] :
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/adschema/adschema/a_lockouttime.asp
.
- Follow-Ups:
- Re: How to retrieve all locked user account from ADAM?
- From: Joe Kaplan \(MVP - ADSI\)
- Re: How to retrieve all locked user account from ADAM?
- Prev by Date: Re: One domain controller for several dmzs
- Next by Date: Re: Password Age
- Previous by thread: Logon Windows property and Sharepoint
- Next by thread: Re: How to retrieve all locked user account from ADAM?
- Index(es):
Relevant Pages
|
