We're running active directory on a Win2000 server. I am trying with a .net application to produce a list of all users that have the property "user cannot change password" enabled.
From what I've read I thought I would be able to obtain this by examing the userAccountControl property for the PASSWD_CANT_CHANGE value of 64. My actual results however are showing a value of 66048 which I interpret to mean DONT_EXPIRE_PASSWORD (65536) + NORMAL_ACCOUNT (512). I am getting the value of 66048 for users whether or not they have their user cannot change password flag enabled.
I am far from being an expert working with AD so any explanations or suggestions would be appreciated.
Start Free Trial