HEELPBOOK - Active Directory - Find All Locked Out Accounts #################################

Use Saved Queries to quickly locate all locked out user accounts.

You can use the Saved Queries feature of Windows Server 2003 to query Active Directory for any locked-out accounts. Just open the Active Directory Users and Computers console, right-click on Saved Queries in the console tree and select New -> Query.

Type a name and description for the query, specify a query root (where in your namespace your query begins searching), and click the Define Query button.
Since there's no default option for finding locked-out accounts in the Common Queries box, select Custom Search instead to open the Find Custom Search box.

Then select the Advanced tab and enter the following LDAP string in the Enter LDAP Query textbox:


(&(&(&(objectCategory=person)(objectClass=user)(lockoutTime:1.2.840.113556.1.4.804:=4294967295))))


Click OK twice to create and run the saved query.

The string works on Windows Server 2003 SP1.


### Update: Here's another LDAP query that finds all locked out accounts:

(&(objectCategory=Person)(objectClass=User)(lockoutTime>=1))


############ SOLUTION (Alternative) by HeelpbBook Staff

If none of these works you could try the following one, tested even on R2 releases:


(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=2))


Hope this helps!


############ ARTICLE INFO #############

Article Month: July
Article Date: 23/07/2012
Permalink: http://heelpbook.altervista.org/2012/active-directory-find-all-locked-out-accounts/
Source: http://kapothi.com/?p=106
Language: English

View more articles on: http://www.heelpbook.net/
Follow us on Facebook: http://it-it.facebook.com/pages/HeelpBook/100790870008832
Follow us on Twitter: https://twitter.com/#!/HeelpBook
Follow us on RSS Feed: http://feeds.feedburner.com/Heelpbook
Follow us on Delicious: http://delicious.com/heelpbook
Linkedin: http://it.linkedin.com/pub/stefano-maggi/27/73a/b20