Unlock AD Accounts Automatically?

LDAP query that finds all locked out accounts:
 
(&(objectCategory=Person)(objectClass=User)(lockoutTime>=1))

VBScript

Option Explicit
Dim userid
Dim UsrObj
Dim provider
Dim OU
Dim domain
Dim oCN
Dim oUname
 
Const Five_Sec = 5000 'sets a value to the Five_Sec
provider = "LDAP://" 
OU = "ou=Delegated Users,ou=IM&T Users,ou=UBHT IM&T," 'path to OU
domain = "dc=ubht,dc=nhs,dc=uk" 'distinguished domain name
oCN = "CN=" 'canonical name
oUname = "RemoteInstall,"
 
Set UsrObj = GetObject(provider & oCN & oUname & OU & domain) 'sets
variable to equal distinguished name as specified above
 
Do While True 'start continous loop
   If CBool(UsrObj.IsAccountLocked) Then
  UsrObj.IsAccountLocked = False
  UsrObj.SetInfo
 
End If
   WScript.Sleep(Five_Sec) 'Pauses 5secs before
looping again
Loop 

                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:

I would not recommend doing this, but GROUP POLICY is the easiest.

You can change the Account Lockout Duration time.  
Computer Configuration\Windows Settings\Security Settings\Account Polices\Account Lockout Policy.

Or if you have admin pack installed, use dsquery to find the locked accounts and use dsmod to unlock them

checking current groups of a named user
- dsget user "CN=Ryan Coates,CN=Users,DC=godlike,DC=Com" -memberof
adding a user to a new group
- dsmod group "CN=Domain Admins,CN=Users,DC=godlike,DC=Com" -addmbr "CN=Ryan Coates,CN=Users,DC=godlike,DC=Com"
searching for a group (like you can in the GUI AD)
- dsquery group -name Domain*
password resets
- dsmod user "CN=Ryan Coates,CN=Users,DC=godlike,DC=Com" -pwd l0s3r -mustchpwd yes
searching for a user
- dsquery user -name Ryan*
unlocking an account
- dsmod user "CN=Ryan Coates,CN=Users,DC=godlike,DC=Com" -disabled no

A better way to do all that is pipe it all through the dsquery command so you dont have to use the full DN for most of those
like say changing a passowrd

- dsquery user -name Ryan*
if that returns only one result press UP to get your history back and add to it
- dsquery user -name Ryan* | dsmod user -pwd l0s3r -mustchpwd yes

Check out these links for more detailed use of these tools
DSMod (http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/ServerHelp/3558c421-ba3d-4b8f-a107-b9058cc0f286.mspx)
DSQuery (http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/ServerHelp/46ba1426-43fd-4985-b429-cd53d3046f01.mspx)
DSGet (http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/ServerHelp/96a4a5ee-ee72-44d5-845f-71b2de33d441.mspx)

Thanks Netcmh!

On the LDAP query, I modified the script however I get a syntax error at Line 18, Char 10.

See below for the modified script. The joetools is excellent! Granted it's not autmatic - it only takes an alt-tab and a couple of key strokes..

Option Explicit
Dim userid
Dim UsrObj
Dim provider
Dim OU
Dim domain
Dim oCN
Dim oUname
 
Const Ten_Min = 600000 'sets a value to the Ten_Min
provider = "LDAP://" 
OU = "ou=Delegated Users,ou=IM&T Users,ou=UBHT IM&T," 'path to OU
domain = "dc=CSDC1,dc=CSDC2,dc=CSDC3" 'distinguished domain name
oCN = "CN=" 'canonical name
oUname = "Company_Users,"
 
Set UsrObj = GetObject(provider & oCN & oUname & OU & domain) 'sets
variable to equal distinguished name as specified above
 
Do While True 'start continous loop
   If CBool(UsrObj.IsAccountLocked) Then
  UsrObj.IsAccountLocked = False
  UsrObj.SetInfo
 
End If
   WScript.Sleep(Ten_Min) 'Pauses 10Min before
looping again
Loop 
 
                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:

If you're using the script exactly as you entered it there, it looks to me like line 18 is a line wrap from 17.  Add a ' to the beginning of line 18 and try tunning it then.

That's one HUGE reason why I think in-line comments in code are a poor idea..



HTH,
exx

And here is a one liner you could use with PowerShell+Quest Cmdlets

Get-QADUser -sl 0 -Locked | Unlock-QADUser

exx1976: is correct in that line wrap issue

Yes that was correct - thank you for catching that

I'm now recieving a return message : "A referral was returned by the server"

I've verified the correct LDAP address on line 11

provider = "LDAP://"
 

Excellent tool, easy to user - can't complain. Thanks!