How to: Enable or Disable User Accounts in Active Directory Domain Services
You can enable or disable a user account in Active Directory Domain Services (AD DS) by setting the appropriate constants in the userAccountControlattribute of the user account.
You can set these constants in the MapAttributesForExport method of the management agent rules extension. When the management agent is executed, the server calls the MapAttributesForExport method as part of the synchronization process.
UserAccountControl Constants
You can use the following constants with the userAccountControl attribute.
Const ADS_UF_SCRIPT = &H1 ' The logon script will be executed.
Const ADS_UF_ACCOUNTDISABLE = &H2 ' Disable user account.
Const ADS_UF_HOMEDIR_REQUIRED = &H8 ' Requires a root directory.
Const ADS_UF_LOCKOUT = &H10 ' Account is locked out.
Const ADS_UF_PASSWD_NOTREQD = &H20 ' No password is required.
Const ADS_UF_PASSWD_CANT_CHANGE = &H40 ' The user cannot change the password.
Const ADS_UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED = &H80 ' Encrypted password allowed.
Const ADS_UF_TEMP_DUPLICATE_ACCOUNT = &H100 ' Local user account.
Const ADS_UF_NORMAL_ACCOUNT = &H200 ' Typical user account.
const long ADS_UF_SCRIPT = 0x0001; // The logon script will be executed.
const long ADS_UF_ACCOUNTDISABLE = 0x0002; // Disable user account.
const long ADS_UF_HOMEDIR_REQUIRED = 0x0008; // Requires a root directory.
const long ADS_UF_LOCKOUT = 0x0010; // Account is locked out.
const long ADS_UF_PASSWD_NOTREQD = 0x0020; // No password is required.
const long ADS_UF_PASSWD_CANT_CHANGE = 0x0040; // The user cannot change the password.
const long ADS_UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED = 0x0080; // Encrypted password allowed.
const long ADS_UF_TEMP_DUPLICATE_ACCOUNT = 0x0100; // Local user account.
const long ADS_UF_NORMAL_ACCOUNT = 0x0200; // Typical user account.
For more information about these user account control constants, ADS_USER_FLAG_ENUM.
Note
You cannot assign the permission settings of PASSWD_CANT_CHANGE by directly modifying the UserAccountControl attribute. For more information, and a code example that shows how to prevent a user from changing the password, see User Cannot Change Password.
The following examples show how to enable or disable a user account based on a metaverse entry.
Public Sub MapAttributesForExport( _
ByVal FlowRuleName As String, _
ByVal mventry As MVEntry, _
ByVal csentry As CSEntry) _
Implements IMASynchronization.MapAttributesForExport
Const ADS_UF_NORMAL_ACCOUNT = &H200
Const ADS_UF_ACCOUNTDISABLE = &H2
Select Case FlowRuleName.ToString()
Case "userAccountControl"
Dim currentValue As Long
If csentry("useraccountcontrol").IsPresent Then
currentValue = csentry("useraccountcontrol").IntegerValue
Else
currentValue = ADS_UF_NORMAL_ACCOUNT
End If
Select Case mventry("employeeStatus").Value
Case "active"
csentry("useraccountcontrol").IntegerValue = (currentValue Or ADS_UF_NORMAL_ACCOUNT) _
And (Not ADS_UF_ACCOUNTDISABLE)
Case "inactive"
csentry("useraccountcontrol").IntegerValue = currentValue _
Or ADS_UF_ACCOUNTDISABLE _
Or ADS_UF_PASSWD_NOTREQD
End Select
End Select
End Sub
void IMASynchronization.MapAttributesForExport(
string FlowRuleName,
MVEntry mventry,
CSEntry csentry)
{
const long ADS_UF_NORMAL_ACCOUNT = 0x200;
const long ADS_UF_ACCOUNTDISABLE = 0x2;
const string USER_ACCOUNT_CONTROL_PROP = "userAccountControl";
switch(FlowRuleName)
{
case "userAccountControl":
long currentValue = ADS_UF_NORMAL_ACCOUNT;
if(csentry[USER_ACCOUNT_CONTROL_PROP].IsPresent)
{
currentValue = csentry[USER_ACCOUNT_CONTROL_PROP].IntegerValue;
}
switch(mventry["employeeStatus"].Value.ToLower())
{
case "active":
csentry[USER_ACCOUNT_CONTROL_PROP].IntegerValue = (currentValue | ADS_UF_NORMAL_ACCOUNT)
& ~ADS_UF_ACCOUNTDISABLE;
break;
case "inactive":
csentry[USER_ACCOUNT_CONTROL_PROP].IntegerValue = currentValue
| ADS_UF_ACCOUNTDISABLE
| ADS_UF_PASSWD_NOTREQD;
break;
}
break;
}
}