[英]How can I verify if an AD account is locked?
I want to know if it is possible to verify if a specific AD account is locked. 我想知道是否可以验证特定的AD帐户是否被锁定。
The command Get-ADUser
does not return this parameter : 命令Get-ADUser
不返回此参数:
-------------------------- EXAMPLE 3 -------------------------- Command Prompt: C:\PS> Get-ADUser GlenJohn -Properties * - Surname : John - Name : Glen John - UserPrincipalName : jglen - GivenName : Glen - Enabled : False - SamAccountName : GlenJohn - ObjectClass : - user SID :S-1-5-21-2889043008-4136710315-2444824263-3544 - ObjectGUID :e1418d64-096c-4cb0-b903-ebb66562d99d - DistinguishedName : CN=Glen John,OU=NorthAmerica,OU=Sales,OU=UserAccounts,DC=FABRIKAM,DC=COM Description : ----------- Get all properties of the user with samAccountName 'GlenJohn'. --------------------------END EXAMPLE --------------------------
Is there an other way to get this information ? 有没有其他方法来获取此信息?
The LockedOut
property is what you are looking for among all the properties you returned. LockedOut
属性是您在返回的所有属性中寻找的属性。 You are only seeing incomplete output in TechNet. 您只看到TechNet中的输出不完整。 The information is still there. 信息仍在那里。 You can isolate that one property using Select-Object
您可以使用Select-Object
隔离该属性
Get-ADUser matt -Properties * | Select-Object LockedOut
LockedOut
---------
False
The link you referenced doesn't contain this information which is obviously misleading. 您引用的链接不包含此信息,这显然具有误导性。 Test the command with your own account and you will see much more information. 使用您自己的帐户测试命令,您将看到更多信息。
Note: Try to avoid -Properties *
. 注意:尽量避免使用-Properties *
。 While it is great for simple testing it can make queries, especially ones with multiple accounts, unnecessarily slow. 虽然它非常适合简单测试,但它可以使查询,特别是具有多个帐户的查询不必要地慢。 So, in this case, since you only need lockedout
: 所以,在这种情况下,因为你只需要lockedout
:
Get-ADUser matt -Properties LockedOut | Select-Object LockedOut
Here's another one: 这是另一个:
PS> Search-ADAccount -Locked | Select Name, LockedOut, LastLogonDate
Name LockedOut LastLogonDate
---- --------- -------------
Yxxxxxxx True 14/11/2014 10:19:20
Bxxxxxxx True 18/11/2014 08:38:34
Administrator True 03/11/2014 20:32:05
Other parameters worth mentioning: 其他参数值得一提:
Search-ADAccount -AccountExpired
Search-ADAccount -AccountDisabled
Search-ADAccount -AccountInactive
Get-Help Search-ADAccount -ShowWindow
I found also this list of property flags: How to use the UserAccountControl flags 我还找到了这个属性标志列表: 如何使用UserAccountControl标志
SCRIPT 0x0001 1
ACCOUNTDISABLE 0x0002 2
HOMEDIR_REQUIRED 0x0008 8
LOCKOUT 0x0010 16
PASSWD_NOTREQD 0x0020 32
PASSWD_CANT_CHANGE 0x0040 64
ENCRYPTED_TEXT_PWD_ALLOWED 0x0080 128
TEMP_DUPLICATE_ACCOUNT 0x0100 256
NORMAL_ACCOUNT 0x0200 512
INTERDOMAIN_TRUST_ACCOUNT 0x0800 2048
WORKSTATION_TRUST_ACCOUNT 0x1000 4096
SERVER_TRUST_ACCOUNT 0x2000 8192
DONT_EXPIRE_PASSWORD 0x10000 65536
MNS_LOGON_ACCOUNT 0x20000 131072
SMARTCARD_REQUIRED 0x40000 262144
TRUSTED_FOR_DELEGATION 0x80000 524288
NOT_DELEGATED 0x100000 1048576
USE_DES_KEY_ONLY 0x200000 2097152
DONT_REQ_PREAUTH 0x400000 4194304
PASSWORD_EXPIRED 0x800000 8388608
TRUSTED_TO_AUTH_FOR_DELEGATION 0x1000000 16777216
PARTIAL_SECRETS_ACCOUNT 0x04000000 67108864
You must make a binary-AND of property userAccountControl
with 0x002
. 您必须使用0x002
属性userAccountControl
的二进制AND。 In order to get all locked (ie disabled) accounts you can filter on this: 为了获得所有锁定(即禁用)帐户,您可以对此进行过滤:
(&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=2))
For operator 1.2.840.113556.1.4.803
see LDAP Matching Rules 对于运算符1.2.840.113556.1.4.803
请参阅LDAP匹配规则
This ScriptingGuy guest post links to a script by a Microsoft Powershell Expert can help you find this information, but to fully audit why it was locked and which machine triggered the lock you probably need to turn on additional levels of auditing via GPO. 这篇ScriptingGuy来宾帖子链接到Microsoft Powershell Expert的脚本可以帮助您查找此信息,但要完全审核它被锁定的原因以及哪台机器触发了锁定,您可能需要通过GPO打开其他级别的审核。
https://gallery.technet.microsoft.com/scriptcenter/Get-LockedOutLocation-b2fd0cab#content https://gallery.technet.microsoft.com/scriptcenter/Get-LockedOutLocation-b2fd0cab#content
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.