0

I have a situation where I'd like to use PowerShell in an environment without Get-ADUser to determine whether another account is expired. Someone else in the domain is able to read the userAccountControl property off of the object returned from an adsi call, and see the PASSWORD_EXPIRED (8388608) bit is set. When my account makes this same call, the bit is always off, which leads me to believe there is a difference in permissions in the requesting accounts that prevents me from seeing this information.

It also would seem to obviate the strict need to query the ms-DS-User-Account-Control-Computed, which I can't quite figure out how to query anyways. If that might make the difference, please point me to a way to do this in PowerShell. If it's not necessary, what permissions are required to read this value?

I'm not the most well versed in ADSI or even AD permissions and the various ways to get things, just a general idea... The results object whose properties I am getting is acquired with he following ADSI string: (&(objectClass=user)(objectCategory=person)(samAccountName=queried.user.name*)) -- all the properties coming off of it seem to be valid, except for several flags in the useraccountcontrol property(?)

Code Jockey
  • 6,611
  • 6
  • 33
  • 45
  • Powershell follows AD permissions. Using a different method of access shouldn't change the results. Does this work if you replace acctname with the account name you are interested in? `search-adaccount -accountexpired |where {$_.name -eq "acctname"}` – uSlackr Oct 18 '16 at 16:54
  • @uSlackr -- I'm not sure where to make the change to try that - I added my query string if that helps you understand where I'm starting from. -- I pass this into the PowerShell `[adsisearcher]` type accelerator construct and then `FindOne()` to get the first result – Code Jockey Oct 18 '16 at 17:19
  • oh - so that's not recognized as a cmdlet - I'd guess it would come along with get-aduser or something(?) – Code Jockey Oct 18 '16 at 17:20
  • yes - it comes with the AD mgmt. tools. – uSlackr Oct 18 '16 at 17:45
  • Well, the answer is that I don't have the AD management tools on the box, so an error occurs – Code Jockey Oct 18 '16 at 17:48

0 Answers0