Database Search
If you can't find the information using the categories below, post a question over in our WinBatch Tech Support Forum.
TechHome
ADSI
 |
- !!!NEWSFLASH!!!
- !Reading List
- 1063 Object Doesnt Exist
- 1068 Error trying to duplicate user groups
- 1073 Cannot Contact the LDAP Server
- 234 Unable to Parse ADSI Path on WinPE
- 275 Search Return Too Many Object Paths
- Active Directory - Force Replication
- ACTIVEDS.dll could not be Found in the Specified Path
- AD Account Creation Date
- AD Event Monitoring Issues
- AD Locked Account Problem
- AD MachineRole Property
- AD OU Membership
- AD Password Expires Date
- Add a user to a OU
- Add more then one Othermailbox to Account
- Add New Mail Account to users that do not have one
- Adding a Machine to an AD Domain
- Adding a workstation (NT4 and W2k) to the domain
- Adding a Workstation to AD in Correct OU
- Adding NT4 Global Group to a Windows 2000 Domain Local Group
- ADSI and COM
- ADSI Function Equivalent to wntMemberSet
- ADSI IIS related bug in Win2k3 sp1
- ADSI Scriptomatic
- ADSI Special Characters
- ADSI Support on Windows PE
- Attributes - Property Names - of an AD Account
- Bad Path Error on NT4
- Binding to the Global Catalog
- BitLocker Recovery Key
- Check for Admin Access
- Check if a Computer Belongs to a Certain OU
- Check if User Account Object Exists
- Check to see if Print Services are Running
- COM - Active Directory Published Certificates Info
- Convert Qword
- Converting Properties to a Human Readable Form
- Copy User or Computer account in AD
- Create a Mailbox and NT-Security-Descriptor property
- Create an OU in ADSI
- Create Virtual Directory
- Creating Computer Accounts
- Creating IIS 5 FTP Users
- Date AD account was modified last
- Delete Mailbox in Exchange
- Detect Disabled Accounts
- Disable Computer Accounts
- Display list of OUs
- Distribution List and Members
- Dont Expire Password
- dsAddtoGrp 1063 Object Does Not Exist
- dsAddToGrp and What is TESTECH
- dsDeleteObj Issue
- dsFindPath Limitation
- dsFindPath Search Request Slow
- dsfindpath Syntax Error
- dsFindPath with NULL Criteria
- dsGetMemGrp Sample
- dsGetProperty Error 1001 Using Slash in Path
- dsGetUsersGrps Error 1001
- dsGetUsersGrps Problem
- dsMoveObj error 1068
- dssetcredentx Error - The Requested Object does not Exist
- dsSetPassword and Blank Passwords
- dsSetProperty Error 246 Custom Attribute
- dsSetProperty userAccountControl
- dsSetSecProp Set Security Permission
- Editing IIS Properties in 2003 SP1
- Enumerating computers in a Win2k AD domain
- Error 1026 - the specified domain either does not exist or could not be contacted
- Error 1045 Operation is not Allowed on RDN
- Error 1047 Creating Exchange 5.5 Mailbox
- Error 1047 Operations Error Occured
- Error 1047 with dsCreateObj on Exchange 2K
- Error 1062 Constraint Violation Setting pwdLastSet Property
- Error 1063 using dsObjCreate
- Error 1068 The server is unwilling to Perform
- Error 1068 with dsSetObj on New User Account
- Error 212
- Error 222 with dsGetChildPath
- Error 234 Unable to parse ADSI path on NT4
- Error 239 Attempting to Rename an Account
- Error 241 when trying to remove a user from group
- Error 243 - Not a property of the object.
- Error 246 - Propertys syntax not supported
- Errors 1001 and 1026
- Examples for ADSI not working
- Exchange with ADSI
- Extract SMTP address in Exch 5 5
- Find DHCP
- Find Exchange Servers
- Finding a Users Exchange Server
- Force Password Change for ADSI User
- ForeignSecurityPrincipals Issue
- Get Computer Names
- Get Current User Path
- Get Effective Permissions
- Get Exchange Server a Users Mailbox is On
- Get List of all Exchange Aliases from Active Directory
- Get Logged In User
- Get User Properties
- Get Users Full Mame from their Logon ID
- Getting LastLoginTimestamp Value in ADSI
- Group Membership Checking
- How do I set the Password and Other Properties
- How to Get at Virtual Dirs
- How to Interpret UserFlags
- How to Pull all ObjectClass Items
- How to Rename an Account
- How to Specify ADSI Paths
- Instantiating Application Objects with ADSI
- LDAP Path with Comma
- LDAP Query Syntax
- List and Retrieve Groups in an OU
- List Computer Objects
- List Disabled User Accounts on the Domain
- List Groups a User is a Direct Member Of
- List Groups Computer is Member Of
- List Groups in OU
- List OU Objects
- List Users that Belong to an OU W2k AD
- List Users with Multiple Attributes
- Lookup Hidden Mailboxes in Exchange 5.5
- Member of Nested Group
- Modify UserAccountControl Attribute
- Move computer between containers
- MsExchMailboxSecurityDescriptor
- Name display --lastname, firstname
- Problem doing CreateMailbox on Exchange 5
- Problem Getting and Settind the AccountExpires Active Directory Property
- Proper AD Query
- Proper Syntax for an LDAP Path
- Query User to Identify which OU it Belongs
- Recursive Searching and dsGetChildPath vs dsFindPath
- Removing User Must Change Password At Next Logon
- Rename Computer in AD
- Renaming a Group in Active Directory
- Reset passwords in Active Directory
- Return Closest Domain Controller using ADSI
- RootDSE Explanation
- Search All Users in AD for a Property
- Set AccountExpires attribute
- Set Logon Name - ADSI
- Setting Expiry Date on AD Account
- Synchronize Domain and Local Password Issue
- Terminal Server Properties
- Test if Object is a Group
- Three Ways a User is Part of a Group in AD
- User Permissions on an AD Object
- Users Last Logon Time
- Verifying User Credentials Against AD
- Virtual directories on IIS via ADSI
Can't find the information you are looking for here? Then leave a message over on our WinBatch Tech Support Forum.
Modify UserAccountControl Attribute
Keywords: userAccountControl UserFlags dsSetProperty dsGetPropertyPASSWD_NOTREQD NORMAL_ACCOUNT
Question:
Currently the userAccountControl of most of the accounts in my Active Directory has the following value: (PASSWD_NOTREQD|NORMAL_ACCOUNT) we need to discover all those accounts and remove the PASSWD_NOTEQD using WinBatch.To do the search of all of them I will use
dsFindPath(sSearchPoint, sSearch)with the sSearch something like: "(&(objectCategory=user)(userAccountControl:%xxx%:=%qqq%))" but I don't know the value of xxx and qqq. (for example for the dont_expire_passord xxx=1.2.840.113556.1.4.803 and qqq = 65536)
The second step is to remove the PASSWD_NOTREQD, I can use the command NET USER /passworlreq:yes but I prefer to use
nUserFlags = dsGetProperty(sUserPath, "Userflags")and
dsSetProperty( sUserPath, "Userflags", nUserFlags)but I don't know what value that I need to set to nUserFlags to remove PASSWD_NOTREQD
Would you please give me some hints?
Answer:
http://msdn.microsoft.com/en-us/library/ms680832%28v=VS.85%29.aspx Scroll down to the bottom of the page... there's a table with all of the defined bits that can be present in the value of userAccountControl.In particular, this is of interest:
ADS_UF_PASSWD_NOTREQD - 0x00000020, which is 32 in decimal, and ADS_UF_NORMAL_ACCOUNT - 0x00000200, which is 512 in decimal.
So, your LDAP search filter expression would contain a fragment that looks like this:
"(&(objectCategory=user)(userAccountControl:1.2.840.113556.1.4.803:=544))"
That fragment of the filter expression would find all objects with an object category value of "user" and an userAccountControl value that contains both the bit specified by a decimal value of 32 and the bit specified by the decimal value 512. Effectively, this is all normal user account objects that don't require a password.
After you obtain the value of the userAccountControl attribute for an object by calling dsGetProperty(), you can toggle the password not required bit off by doing the following:
nUserFlags = nUserFlags & (~32)
Finally, call dsSetProperty() to store the new value in that attribute on the same user object.
Article ID: W17535
Filename: Modify UserAccountControl Attribute.txt
File Created: 2011:08:11:07:48:58
Last Updated: 2011:08:11:07:48:58