LDAP PowerShell User Account Control

Comments (1) | Share

The userAccountControl attribute is used to control the access of a user account.  This value can be set to the bitwise OR of a set of flag values, documented here:

So the value of the userAccountControl attribute can be described in PowerShell as the -bor (binary or) of these flags.  A user with the "NORMAL_ACCOUNT" and "DONT_EXPIRE_PASSWORD" flags set would be expressed in PowerShell as 512 -bor 65536 (which equals 66048).

So to make a user account a normal account with a non-expiring password in PowerShell, you can use NetCmdlets set-ldap like so:

PS C:\> set-ldap -server testboy -cred $mycred -dn "CN=Lance Robinson,CN=Users,DC=JUNGLE" 
    -attrtype userAccountControl -attrvalue "66048" -replaceattribute

Host       : testboy
DN         : CN=Lance Robinson,CN=Users,DC=JUNGLE
Successful : True
Type       : userAccountControl
Value      : 66048

PS C:\>

To disable an account, just -bor 2 with whatever the existing value already is.