Re: Unlocking AD Accounts

Dr. Furrfu wrote:

I'm having an issue with unlocking user accounts in AD.

I've delegated the right to unlock accounts to the Helpdesk global group.

If a member of the Helpdesk group tries to unlock the account going
through the MMC, it is successful.

If a member of the Helpdesk group tries to unlock the account by using the
command:

net user userid /active:yes /domain

it is unsuccessful. The following error message is returned:

System error 5 has occurred.
Access is denied.

I'd like the group to use the NET command. I don't see any errors in the
event log.

Has anyone come across this before?

I believe the /active: option either disables or enables the account. It
does not unlock it. I don't see where this command can unlock an account.

If it helps I have an example VBScript program that can unlock user
accounts. It prompts for a user name (the pre-Windows 2000 logon name) then
indicates if the account is locked out. If it is, the program indicates when
the domain policy will unlock the account and asks if you want to unlock the
account. The program is linked here:

http://www.rlmueller.net/IsUserLocked.htm

--
Richard Mueller
Microsoft MVP Scripting and ADSI
Hilltop Lab - http://www.rlmueller.net
--


.

Relevant Pages