Column
Custom LDAP Query To Show Locked User Accounts
How can I create a custom LDAP query that will allow me to determine locked user accounts in Windows Server 2003?
by Zubair Alexander
9/12/2007 -- You can use the Saved Query feature in Active Directory Users and Computers. Here's the procedure:
- Go to ADUC and right-click on Saved Queries.
- Select New, Query.
- Type in the name and description of the query (e.g., Locked User Accounts) and then click on Define Query.
- In the Find box, select Custom Search and then click on the Advanced tab.
- Enter the following text for the LDAP query:
(&(&(&(objectCategory=person)(objectClass=user)
(lockoutTime:1.2.840.113556.1.4.804:=4294967295))))
- Click OK twice to close all windows.
- Simply highlight the "Locked User Accounts" query and press F5 to refresh. If you have any accounts that are locked, they will show up in the right-hand pane.
If your query fails, it's most likely because you entered carriage returns in the LDAP query. The query does not contain any spaces or carriage returns.
Zubair Alexander, MCSE, MCT, MCSA and Microsoft MVP is the founder of SeattlePro Enterprises, an IT training and consulting business. His experience covers a wide range of spectrum: trainer, consultant, systems administrator, security architect, network engineer, author, technical editor, college instructor and public speaker. Zubair holds more than 25 technical certifications and Bachelor of Science degrees in Aeronautics & Astronautics Engineering, Mathematics and Computer Information Systems. His Web site, www.techgalaxy.net, is dedicated to technical resources for IT professionals. Zubair may be reached at .
|