Tuesday, August 9, 2011

Active Directory and userAccountControl Attribute

As you know, searching Active Directory attributes using DSQUERY commands or scripts is not difficult.  You can get the values directly from the attribute.  However, searching the enabled, disabled status,PasswordExpired  etc can be challenging because these properties/values are not stored in its own attribute.  These account properties are controlled by an attribute called userAccountControl. 

what is userAccountControl ?

It is a 4 bytes (32-bit) integer that represents a bitwise enumeration of various flags that controls the behavior of an object. The attributeID (ruleOD) of this object is 1.2.840.113556.1.4.8.  The attributeID is a unique X.500 Object Identifier(OID) for identifying an attribute. 

image

How do I search userAccountControl values in Active Directory?

It is like searching any other attribute in Active Directory. However, you need to represent the userAccountControl values in numeric.  The syntax of the LDAP matching rule is

attributename:ruleOID:=value

where attributename is the LDAP DisplayName -in this case it is userAccountControl, ruleOID is the attributeID for the matching rule control - in this case it is 1.2.840.113556.1.4.80X, and value is the decimal value you want to use for search.  I will explain the details using a couple of examples. 

The following DSQUERY command returns all disabled user accounts in Active Directory.  

dsquery * -limit 0 –filter "(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=2))" –attr name

userAccountControl = 2 means the user account is disabled (ADS_UF_ACCOUNTDISABLE)

and the following DSQUERY command returns all users with the 'Password Never Expires' settings enabled.

dsquery * -limit 0 –filter "(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=65536))" –attr name

userAccountControl = 65536 means the user account has 'Password Never Expires' flag enabled (ADS_UF_DONT_EXPIRE_PASSWD)

So where did the attributeID (ruleOID) 1.2.840.113556.1.4.803 come from?

The value of attributeID (ruleOID) can be either bitwise AND (1.2.840.113556.1.4.803) or bitwise OR  (1.2.840.113556.1.4.804)

  • 1.2.840.113556.1.4.803 – This is the bitwise AND operator (LDAP_MATCHING_RULE_BIT_AND).  The rule is true only if all bits from the property match the value. 
  • 1.2.840.113556.1.4.804 – This is the bitwise OR operator (LDAP_MATCHING_RULE_BIT_OR).  The rule is true if any bits from the property match the value.

Here is the complete structure:

image

 

How do I get the userAccountControl values? 

These userAccountControl flag values are available in following MSDN articles. Make sure to use Decimal values not HEX. 

  1. http://msdn.microsoft.com/en-us/library/ms680832(v=vs.85).aspx
  2. http://msdn.microsoft.com/en-us/library/aa772300(v=vs.85).aspx

Conclusion

Regardless of what method you use (commands or scripts) you can search Active Directory using userAccountControl flags using the above mentioned syntax. 

Looking for more DSQUERY examples?

Visit my TechNet Wiki article - http://social.technet.microsoft.com/wiki/contents/articles/3537.aspx

 


30 comments:

Great entry Santhosh!!

Mark Empson wrote a UserAccountControl entry that compliments this entry http://blogs.technet.com/b/mempson/archive/2011/08/24/useraccountcontrol-flags.aspx

I now have both in my favorites :)

1.2.840.113556.1.4.803 and 1.2.840.113556.1.4.804 are not related to 1.2.840.113556.1.4.8 whatsoever. They are both OIDs for the bitwise OR and AND operators against any attribute that supports it, and not extensions that would apply to the userAccountControl attribute, as your article sounds...

hi, I'm new to poweshell commands. I try to update my employee numbers for more than 1000 employees. I created file as below :-
Import-module ActiveDirectory
Import-CSV "c:\temp\users.csv" | % {
$User = $_.UserName
$ID = $_.empNumber
Set-ADUser $User -employeeID
}
Saved this file as .ps1, when I tried to run it I will get below error :-
Set-ADUser : Cannot validate argument on parameter 'Identity'. The argument is
null. Supply a non-null argument and try the command again.
At C:\TEMP\UpdateEmployeeID.ps1:5 char:11
+ Set-ADUser <<<< $User -employeeID
+ CategoryInfo : InvalidData: (:) [Set-ADUser], ParameterBindingV
alidationException
+ FullyQualifiedErrorId : ParameterArgumentValidationError,Microsoft.Activ
eDirectory.Management.Commands.SetADUser

how can I rectify this error. if we want to follow other steps then please update me on patilshirishr@gmail.com

Make sure you'll read this article too, guys. It is really important!

I was very happy to find this site. I really enjoyed reading this article today and think it might be one of the best articles I have read so far. I wanted to thank you for this excellent reading !! I really enjoy every part and have bookmarked you to see the new things you post. Well done for this excellent article. Please keep this work of the same quality.
Data Science Course in Bangalore

I really enjoy every part and have bookmarked you to see the new things you post. Well done for this excellent article. Please keep this work of the same quality.
Artificial Intelligence course in Chennai

I want to leave a little comment to support and wish you the best of luck.we wish you the best of luck in all your blogging enedevors.
data analytics courses in bangalore

I want to leave a little comment to support and wish you the best of luck.we wish you the best of luck in all your blogging enedevors.
data analytics courses in bangalore

I am glad to discover this page. I have to thank you for the time I spent on this especially great reading !! I really liked each part and also bookmarked you for new information on your site.
Data Science Course Syllabus

I need to thank you for this very good read and i have bookmarked to check out new things from your post. Thank you very much for sharing such a useful article and will definitely saved and revisit your site.
Data Science Course

Excellent Blog! I would like to thank you for the efforts you have made in writing this post. Gained lots of knowledge.
Data Analytics Course

Awesome article. I enjoyed reading your articles. this can be really a good scan for me. wanting forward to reading new articles. maintain the nice work!
Data Science Courses in Bangalore

What an incredible message this is. Truly one of the best posts I have ever seen in my life. Wow, keep it up.
AI Courses in Bangalore

I am sure it will help many people. Keep up the good work. It's very compelling and I enjoyed browsing the entire blog.
Business Analytics Course in Bangalore

i am glad to discover this page : i have to thank you for the time i spent on this especially great reading !! i really liked each part and also bookmarked you for new information on your site.
artificial intelligence training in chennai

I am glad to discover this page. I have to thank you for the time I spent on this especially great reading !! I really liked each part and also bookmarked you for new information on your site.
Data Science Course Syllabus

Your site is truly cool and this is an extraordinary moving article and If it's not too much trouble share more like that. Thank You..
Digital Marketing Course in Hyderabad

Thank a lot. You have done excellent job. I enjoyed your blog . Nice efforts
Data Science Certification in Hyderabad

Truly mind blowing blog went amazed with the subject they have developed the content. These kind of posts really helpful to gain the knowledge of unknown things which surely triggers to motivate and learn the new innovative contents. Hope you deliver the similar successive contents forthcoming as well.

Data Science in Bangalore

Wow, happy to see this awesome post. I hope this think help any newbie for their awesome work and by the way thanks for share this awesomeness, i thought this was a pretty interesting read when it comes to this topic. Thank you..
Artificial Intelligence Course

Impressive. Your story always bring hope and new energy. Keep up the good work.
best data science institute in hyderabad

i am glad to discover this page : i have to thank you for the time i spent on this especially great reading !! i really liked each part and also bookmarked you for new information on your site.
artificial intelligence training in chennai

I want to leave a little comment to support and wish you the best of luck.we wish you the best of luck in all your blogging enedevors.
data science training in chennai

i am glad to discover this page : i have to thank you for the time i spent on this especially great reading !! i really liked each part and also bookmarked you for new information on your site.
artificial intelligence training in chennai

I bookmarked your website because this site contains valuable information. I am very satisfied with the quality and the presentation of the articles. Thank you so much for saving great things. I am very grateful for this site.

Data Science Training in Bangalore

Wonderful blog found to be very impressive to come across such an awesome blog. I should really appreciate the blogger for the efforts they have put in to develop such amazing content for all the curious readers who are very keen on being updated across every corner. Ultimately, this is an awesome experience for the readers. Anyways, thanks a lot and keep sharing the content in the future too.

Digital Marketing Training in Bangalore

I wanted to leave a little comment to support you and wish you the best of luck. We wish you the best of luck in all of your blogging endeavors.

Artificial Intelligence Training in Bangalore

You actually make it seem like it's really easy with your acting, but I think it's something I think I would never understand. I find that too complicated and extremely broad. I look forward to your next message. I'll try to figure it out!

Machine Learning Course in Bangalore

Post a Comment

Popular Posts

Share

Twitter Delicious Facebook Digg Stumbleupon Favorites More