JSI Tip 8549. How can I report all locked accounts?
Jerold Schulman
October 5, 2004
1 Min Read
Using DSQUERY from the Active Directory command-line tools, I have scripted AccountLocked.bat to report all user accounts that are currently locked.
The syntax for using AccountLocked.bat is:
AccountLocked
AccountLocked.bat interrogates the userAccountControl attribute by calling userAccountControl.bat, which must be in a folder that is in your PATH.
The output is displayed on the console, using the following format:
UserName UserDistinguishedName
AccountLocked.bat contains:
@echo offsetlocalset qry=dsquery * domainroot -filter "(&(objectCategory=Person)(objectClass=User))" -attr userAccountControl sAMAccountName distinguishedName -limit 0for /f "Skip=1 Tokens=1,2*" %%a in ('%qry%') do ( call :testit %%b "%%c" %%a)endlocalgoto :EOF:testitif "%3" EQU 0 goto :EOFset user=%1set dn=%2call userAccountControl %3 stringset locked=Nfor /f "Tokens=*" %%L in ('@echo %string%^|FIND "LOCKOUT"') do ( set locked=Y)if "%locked%" EQU "N" goto :EOFset dn=%dn: =%set dn=%dn: "="%@echo %user% %dn%
About the Author
Sign up for the ITPro Today newsletter
Stay on top of the IT universe with commentary, news analysis, how-to's, and tips delivered to your inbox daily.
You May Also Like