How can I find the Active Directory users who have the "Cannot Change Password" set by LDAP query?

Question

I want to find out list of users whose account is set to "cannot change password". How can I find by LDAP query? Script is also appreciated. I just need to find out the list.

Copy-pasting the title into the question and hitting "post" is your level of effort? — Tomalak, Nov 14 '20 at 06:53
Tell us what you have tried and show logs or results and Read: https://stackoverflow.com/help/how-to-ask — jwilleke, Nov 14 '20 at 08:42

score 1 · Accepted Answer · answered Nov 14 '20 at 08:42

1

This LDAP search filter should find what you have asked:

(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=64))

This works due to the Bitwise operation Extensible Match Rules provided within Active Directory.

answered Nov 14 '20 at 08:42

jwilleke

10,467
1
30
51

How can I find the Active Directory users who have the "Cannot Change Password" set by LDAP query?

1 Answers1