Active Directory Properties for "User Cannot Change Password"

i also came across this that might help:

http://www.scriptinganswers.com/archive/articles/UserAccountControl.htm

I appreciate your response but unfortunately that doesn't help me.  I can get the values out fine they just aren't the results I'm expecting.

For a simple test case and cleared all of the optional properties for a user and query the userAccountControl value and get a result of 512 (Normal Account).  Now I edit the user and check "User Cannot Change Passoword" and run my query again and I still get a result of 512 - as I understand it I should get a result of 576 (512 + 64).  [ I also tried a custom search within AD using: (&(objectclass=person) (userAccountControl=576)) and it didn't return any values so I don't think the problem is with retrieving the values. ]

I suspect there is something basic I'm missing or something with the way our AD is setup that is obscuring this value.

Any other thoughts?

i don't know but i found a freeware tool that you might be able to use with better results

http://joeware.net/freetools/tools/adfind/index.htm

i found it in this thread

http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Server/Windows_2003_Active_Directory/Q_22787115.html

Again appreciate the suggestion but no luck.  adfind search returns the same results.

That's actually a pretty tricky one. While you can set it using the Flags you can't enumerate or remove it in the same way.

You have to enumerate the Security Descriptor for the account to see if it's been set or not. That can get quite complex, however if you're interested in continuing there's an MSDN page on this:

http://msdn2.microsoft.com/en-us/library/aa746448.aspx

Chris

I'll check that out and let you know how it goes.

Hi Chris,

I think I'm tantalizingly close.  I have gotten the following code working but I *think* it is pulling back the admin user object from AD and returning admin properties.  I need to run a report for all users and I obviously don't know their passwords - do you have any idea where I'm off?

dso = GetObject("LDAP:")
oUser = dso.OpenDSObject("LDAP://bi", "--my userid--", "--my password--", 1)
oSecDesc = oUser.Get("ntSecurityDescriptor")
oACL = oSecDesc.DiscretionaryAcl

For Each oACE In oACL
  If UCase(oACE.ObjectType) = UCase(CHANGE_PASSWORD_GUID) Then
    If oACE.Trustee = "Everyone" And
       oACE.AceType = ADS_ACETYPE_ACCESS_DENIED_OBJECT Then
         fEveryone = True
    End If

    If oACE.Trustee = "NT AUTHORITY\SELF" And
      oACE.AceType = ADS_ACETYPE_ACCESS_DENIED_OBJECT Then
        fSelf = True
    End If
  End If
Next

Return (fSelf AND fEveryone)

Hey again,

You don't need to use the username and password of the account you're binding to, only a username and password of an account with permission to read the directory (any account in the domain).

So, generally I don't use OpenDSObject method at all when running administrative queries, instead I use the GetObject for an ADSI connection using current credentials:

Set objUser = GetObject("LDAP://CN=Users Name,OU=SomeOU,DC=Domain,DC=local")

Are you looking to return all user objects from the directory as well? Or how is the current user you're getting the information for being defined?

Chris

Appreciate your patience...  My ultimate goal is to produce a list of users that don't have permisson to change their password (this will go into a database as part of a larger project but for now I just want to see the list).

I began with this code (asterisks replace sensitive info):

        Dim objGroupEntry As DirectoryEntry
        Dim objSearchADAM As DirectorySearcher
        Dim objSearchResults As SearchResultCollection
        Dim objResult As SearchResult

        objSearchADAM = New DirectorySearcher(New DirectoryEntry("LDAP://bi.*******.com"))
        objSearchADAM.PropertiesToLoad.Add("samAccountName")
        objSearchADAM.PropertiesToLoad.Add("objectClass")
        objSearchADAM.Sort.PropertyName = "samAccountName"
        objSearchADAM.SearchScope = SearchScope.Subtree
        objSearchADAM.Filter = "(&(objectClass=person))"
        objSearchResults = objSearchADAM.FindAll()

        For Each objResult In objSearchResults

            objGroupEntry = objResult.GetDirectoryEntry()
            Response.Write("<br>Person: " & objGroupEntry.Properties("samAccountName").Value & "...")
            Response.Write("Control: " & objGroupEntry.Properties("userAccountControl").Value & "...")            
          '*** IS USER PERMITTED TO CHANGE THEIR PASSWORD? ***

        Next objResult

Where I want to determine if user can change their password I created a function with the code I posted previously.  This executed but returned FALSE for every user (should be roughly 50% true).

I tried changing to the code you suggested:
  objUser = GetObject("LDAP://CN=JoeUser,DC=bi,DC=local")

And this throws an error "Cannot Create ActiveX Object".  I left out the "OU" piece of it because afaik we don't do anything with it.

Does this make any sense to you?

Chris - That did it.  A few tweaks to make it .Net compatible and it is now working perfectly - thanks so much for the help! - frodoman

For any future readers the following .Net code produces the output desired:
=======================================================

Imports System.DirectoryServices
Imports ActiveDs

Protected Sub Page_Load(ByVal sender As Object, _
            ByVal e As System.EventArgs) Handles Me.Load

  Dim objGroupEntry As DirectoryEntry
  Dim objSearchADAM As DirectorySearcher
  Dim objSearchResults As SearchResultCollection
  Dim objResult As SearchResult
  Dim bLockedPWord As Boolean

  objSearchADAM = New DirectorySearcher(New _
    DirectoryEntry("LDAP://DOMAIN.COMPANY.com"))
  objSearchADAM.PropertiesToLoad.Add("samAccountName")
  objSearchADAM.PropertiesToLoad.Add("objectClass")
  objSearchADAM.Sort.PropertyName = "samAccountName"
  objSearchADAM.SearchScope = SearchScope.Subtree
  objSearchADAM.Filter = "(&(objectClass=person))"
  objSearchResults = objSearchADAM.FindAll()

  For Each objResult In objSearchResults
    objGroupEntry = objResult.GetDirectoryEntry()
    Response.Write("Account: " & objGroupEntry.Properties _
      ("samAccountName").Value & "...")
    bUserCantChangePWord = IsPWordLocked(objGroupEntry)
    Response.Write("Password Flag: " & bLockedPWord & "<br>")
  Next objResult
  Response.Flush()

End Sub

Function IsPWordLocked(ByVal oUser As DirectoryEntry) As Boolean

  Const ADS_ACETYPE_ACCESS_DENIED_OBJECT = &H6
  Const CHANGE_PASSWORD_GUID = _
             "{AB721A53-1E2F-11D0-9819-00AA0040529B}"

  Dim oSecDesc As IADsSecurityDescriptor
  Dim oACL As IADsAccessControlList
  Dim oACE As IADsAccessControlEntry
  Dim fEveryone As Boolean = False
  Dim fSelf As Boolean = False

  oSecDesc = oUser.InvokeGet("ntSecurityDescriptor")
  oACL = oSecDesc.DiscretionaryAcl

  For Each oACE In oACL
    If UCase(oACE.ObjectType) = UCase(CHANGE_PASSWORD_GUID) Then
      If oACE.Trustee = "Everyone" And oACE.AceType = _
                       ADS_ACETYPE_ACCESS_DENIED_OBJECT Then
        fEveryone = True
      End If

      If oACE.Trustee = "NT AUTHORITY\SELF" And oACE.AceType = _
                       ADS_ACETYPE_ACCESS_DENIED_OBJECT Then
        fSelf = True
      End If
    End If
  Next

  Return (fSelf And fEveryone)
End Function