How to: Enable or Disable User Accounts in Active Directory Domain Services

You can enable or disable a user account in Active Directory Domain Services (AD DS) by setting the appropriate constants in the userAccountControlattribute of the user account.

You can set these constants in the MapAttributesForExport method of the management agent rules extension. When the management agent is executed, the server calls the MapAttributesForExport method as part of the synchronization process.

UserAccountControl Constants

You can use the following constants with the userAccountControl attribute.

Const ADS_UF_SCRIPT = &H1                             ' The logon script will be executed.
Const ADS_UF_ACCOUNTDISABLE = &H2                     ' Disable user account.
Const ADS_UF_HOMEDIR_REQUIRED = &H8                   ' Requires a root directory.
Const ADS_UF_LOCKOUT = &H10                           ' Account is locked out.
Const ADS_UF_PASSWD_NOTREQD = &H20                    ' No password is required.
Const ADS_UF_PASSWD_CANT_CHANGE = &H40                ' The user cannot change the password.
Const ADS_UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED = &H80   ' Encrypted password allowed.
Const ADS_UF_TEMP_DUPLICATE_ACCOUNT = &H100           ' Local user account.
Const ADS_UF_NORMAL_ACCOUNT = &H200                   ' Typical user account.
const long ADS_UF_SCRIPT = 0x0001;                          // The logon script will be executed.
const long ADS_UF_ACCOUNTDISABLE = 0x0002;                  // Disable user account.
const long ADS_UF_HOMEDIR_REQUIRED = 0x0008;                // Requires a root directory.
const long ADS_UF_LOCKOUT = 0x0010;                         // Account is locked out.
const long ADS_UF_PASSWD_NOTREQD = 0x0020;                  // No password is required.
const long ADS_UF_PASSWD_CANT_CHANGE = 0x0040;              // The user cannot change the password.
const long ADS_UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED = 0x0080; // Encrypted password allowed.
const long ADS_UF_TEMP_DUPLICATE_ACCOUNT = 0x0100;          // Local user account.
const long ADS_UF_NORMAL_ACCOUNT = 0x0200;                  // Typical user account.

For more information about these user account control constants, ADS_USER_FLAG_ENUM.


You cannot assign the permission settings of PASSWD_CANT_CHANGE by directly modifying the UserAccountControl attribute. For more information, and a code example that shows how to prevent a user from changing the password, see User Cannot Change Password.

The following examples show how to enable or disable a user account based on a metaverse entry.

Public Sub MapAttributesForExport( _
       ByVal FlowRuleName As String, _
       ByVal mventry As MVEntry, _
       ByVal csentry As CSEntry) _
       Implements IMASynchronization.MapAttributesForExport

Select Case FlowRuleName.ToString()
   Case "userAccountControl"
      Dim currentValue As Long
      If csentry("useraccountcontrol").IsPresent Then
         currentValue = csentry("useraccountcontrol").IntegerValue
         currentValue = ADS_UF_NORMAL_ACCOUNT
      End If

      Select Case mventry("employeeStatus").Value
         Case "active"
            csentry("useraccountcontrol").IntegerValue = (currentValue Or ADS_UF_NORMAL_ACCOUNT) _
                                                         And (Not ADS_UF_ACCOUNTDISABLE)
         Case "inactive"
            csentry("useraccountcontrol").IntegerValue = currentValue _
                                                         Or ADS_UF_ACCOUNTDISABLE _
                                                         Or ADS_UF_PASSWD_NOTREQD
      End Select
   End Select
End Sub
void IMASynchronization.MapAttributesForExport(
    string FlowRuleName, 
    MVEntry mventry, 
    CSEntry csentry)
    const long ADS_UF_NORMAL_ACCOUNT = 0x200;
    const long ADS_UF_ACCOUNTDISABLE = 0x2;
    const string USER_ACCOUNT_CONTROL_PROP = "userAccountControl";

        case "userAccountControl":
            long currentValue = ADS_UF_NORMAL_ACCOUNT;
                currentValue = csentry[USER_ACCOUNT_CONTROL_PROP].IntegerValue;

                case "active":
                    csentry[USER_ACCOUNT_CONTROL_PROP].IntegerValue = (currentValue | ADS_UF_NORMAL_ACCOUNT) 
                                                                      & ~ADS_UF_ACCOUNTDISABLE;
                case "inactive":
                    csentry[USER_ACCOUNT_CONTROL_PROP].IntegerValue = currentValue 
                                                                      | ADS_UF_ACCOUNTDISABLE 
                                                                      | ADS_UF_PASSWD_NOTREQD;

See Also




Rules Extensions Examples
Using Rules Extensions