Finding out the attribute name for a User Account

Hi guys,

I hope you are all well and can assist.

I have attached the following picture so you guys now what attribute I am trying to track down.

What I intend to do with this is to create a script that queries this attribute name for its value across all user accounts in our active directory, so we know how many accounts are using DES for encryption.

The intention is to write a query of something like the below:

dsquery * -filter "(&(objectcategory=user)(name=*))" -attr name <whatever the name of this DES attribute is>

Any help greatly appreciated.
Who is Participating?
Mike KlineConnect With a Mentor Commented:
There is no attribute it is part of useraccountcontrol.  Brian talks about it below

I'll write more in the morning about how to find those accounts if no one else responds (need to fire my lab up)


Simon336697Author Commented:
Thanks so much Mike.
i need to find out how many accounts in Active Directory have this option ticked, as opposed to not ticked.
Thanks again Mike.
Mike KlineCommented:
So the useraccountcontrol attribute has values and you add them up for the options you want

There is a great spreadsheet that can help with getting that number

I like to use adfind for things like this (small lightweight tool)

So the first thing to do is to figure out what the useraccount value is.   To see yourself you  can look at one of your users that have it checked and run

adfind -sc u:NameOfUser useraccountcontrol

that should come back with 2097664.  If you calculate that in the spreadhseet it will also show.  That number is  Normal Account (512) + Use_DES_Key_Only (2097152)

To check for all the users that have it checked

adfind -default -bit -f "&(objectcategory=person)(objectclass=user)(useraccountcontrol:AND:=2097152)" samaccountname

Please let me know how that works.


Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Simon336697Author Commented:
that is brilliant info mike. Ill let you know how I go :>)
Thanks so much
Simon336697Author Commented:

It worked really well!

Thank you that was very helpful.
Mike KlineCommented:
Glad to help out.


Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.