Active Directory - not able to update lockouttime attribute.

Question

While Updating lockouttime attribute(as a large integer) for an user in active directory, getting below error.

Operation failed. Error code : 0x57
The parameter is incorrect

00000057: SysErr: DSID-031A12C8, problem 22(Invalid argument), data 0.

any help is appreciated.

Answer 1

In short, this attribute can be only set as 0 to unlock.

Answer 2

Thanks @Aung Zaw Min Thwin for your answer.

https://learn.microsoft.com/en-us/windows/win32/adschema/a-lockouttime
Above documentation says it has a update privilege with domain administrator. if it can be updated to only to 0, then is there any other attribute which i can use to lock an account manually.

Answer 3

Hello there,

You can't set this attribute to an arbitrary value in AD. This is a
Microsoft imposed limitation.

To unlock the account, set this attribute to "0"

To lock the account simulate bad logins until you have reached the defined account lockout threshold

Hope this resolves your Query !!

--If the reply is helpful, please Upvote and Accept it as an answer--

Answer 4

Hi,

As mentioned above it's not possible to set the lockout time attribute to a specific value, by setting the value to 0 (zero) the time is cleared. Another option to try, which is available on other system based attributes, by setting the value to -1, it will set the current time and date. I don't have a system to test it but it's worth a try.

Gary.