Active Directory UserAccountControl Value Not Updating After User Locked Out

0
votes

I have the following code which gives me the value of the user's UserAccountControl AD property:

$samId = "someUserName"

$directorySearcher = New-Object System.DirectoryServices.DirectorySearcher
$directorySearcher.PageSize = 100
$directorySearcher.SearchScope = [System.DirectoryServices.SearchScope]::Subtree
$directorySearcher.Filter = "(&(objectClass=user)(|(sAMAccountName=$samId)))"
$result = $directorySearcher.FindOne()
$uac = $result.Properties["useraccountcontrol"]
Write-Host $uac #output is 512

I have locked out this user in AD by inputting their password incorrectly 3 times. Before I locked out the user the $uac variable was 512. However after locking out the user, $uac still equals 512, whereas it should be equal to 528.

I have set other attributes and can see that these are updated within a few mins, so I don't think it has anything to do with AD replication as I have already waited about 30 mins.

1
powershellactive-directory

1 Answers

1
votes

Since Windows 2003 the LOCKOUT flag is replaced by another constructed attribute msDS-User-Account-Control-Computed.

About LOCKOUT flag is moved:

https://support.microsoft.com/kb/305144/

About msDS-User-Account-Control-Computed:

http://msdn.microsoft.com/en-us/library/cc223393.aspx