JSI Tip 8549. How can I report all locked accounts?

Jerold Schulman

October 5, 2004

1 Min Read
ITPro Today logo in a gray background | ITPro Today


Using DSQUERY from the Active Directory command-line tools, I have scripted AccountLocked.bat to report all user accounts that are currently locked.

The syntax for using AccountLocked.bat is:

AccountLocked

AccountLocked.bat interrogates the userAccountControl attribute by calling userAccountControl.bat, which must be in a folder that is in your PATH.

The output is displayed on the console, using the following format:

UserName UserDistinguishedName

AccountLocked.bat contains:

@echo offsetlocalset qry=dsquery * domainroot -filter "(&(objectCategory=Person)(objectClass=User))" -attr userAccountControl sAMAccountName distinguishedName -limit 0for /f "Skip=1 Tokens=1,2*" %%a in ('%qry%') do ( call :testit %%b "%%c" %%a)endlocalgoto :EOF:testitif "%3" EQU 0 goto :EOFset user=%1set dn=%2call userAccountControl %3 stringset locked=Nfor /f "Tokens=*" %%L in ('@echo %string%^|FIND "LOCKOUT"') do ( set locked=Y)if "%locked%" EQU "N" goto :EOFset dn=%dn:  =%set dn=%dn: "="%@echo %user% %dn%



Sign up for the ITPro Today newsletter
Stay on top of the IT universe with commentary, news analysis, how-to's, and tips delivered to your inbox daily.

You May Also Like