Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

Lock an account in Active Directory using LDAP API

565 views
Skip to first unread message

User

unread,
Oct 27, 2006, 6:27:15 PM10/27/06
to
I am trying to lock an account in Active Directory using LDAP (Java)
API. I try to set the attribute userAccountControl to 528 (512 + 16).
It takes the change but when I query the user object immediately it is
set to 512.

I am assuming I will have to change other attributes in conjunction
with userAccountControl. I tried to set the attribute "lockoutTime" but
I can't change it.

Any ideas on locking the Active Directory account programatically. I
was able to disable (514) though. Just can't lock.

Joe Kaplan

unread,
Oct 27, 2006, 6:53:08 PM10/27/06
to
You can't. The actual bit on userAccountControl isn't used by AD/LDAP.
That is a wierd hold-over flag from the NT domain controller days.

As you have discovered, you can't set lockoutTime to a value either. That
is managed by the system.

The only way to lock out an account programmatically via LDAP is to actually
bind incorrectly enough times in succession to trip the lockout policy.

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
--
"User" <justgi...@gmail.com> wrote in message
news:1161988035.9...@k70g2000cwa.googlegroups.com...

Joe Richards [MVP]

unread,
Oct 28, 2006, 1:15:10 AM10/28/06
to
Why do you want to lock an account versus expire or disable it?

As JoeK mentions, you can't programmatically lock an account except by
generating bad auth.

--
Joe Richards Microsoft MVP Windows Server Directory Services
Author of O'Reilly Active Directory Third Edition
www.joeware.net


---O'Reilly Active Directory Third Edition now available---

http://www.joeware.net/win/ad3e.htm

0 new messages