This version uses the LDAP dialect to search Active Directory. I like this one better than fnADQuery() as the LDAP dialect has more powerful filtering.

Code:

;==========================================================================
;
; NAME: fnLDAPQuery
;
; AUTHOR: Christopher Shilt (christopher.shilt@relizon.com)
; DATE  : 5/11/2005
;
; COMMENT: Uses ADODB to retrieve information from Active Directory
;
;==========================================================================
Break On
 
$=SetOption("WrapAtEOL","on")
$=SetOption("NoVarsInStrings","on")
$=SetOption("Explicit","on")
 
Dim $sWhat,$sFrom,$sFilter,$sScope,$aResults,$Result,$R,$
 
$sWhat = "ADsPath","badPwdCount"
 
$sFrom = "LDAP://"+GetObject("LDAP://rootDSE").Get("defaultNamingContext")
  
; Search for Disabled Users
$sFilter = "(&(objectCategory=person)(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=2))"
 
; Search for Users with badPwdCount greater than 1 (can be used to search for locked accounts)
$sFilter = "(&(objectCategory=user)(badPwdCount>=1))"
 
$sScope = "subtree"
 
$aResults = fnLDAPQuery($sWhat,$sFrom,$sFilter,$sScope)
@ERROR " : " @SERROR ?
 
For Each $Result in $aResults
    If VarType($Result)>8192
        For Each $R in $Result
            $R ?
        Next
    Else
        $Result ?
    EndIf
Next
 
Get $
 
Function fnLDAPQuery($What,$From,Optional $Filter,Optional $Scope,Optional $User,Optional $Pswd)
    Dim $oCon,$oCMD,$oRS,$sF,$sGV,$R,$vP,$aR[0],$nul
    If $Scope <> "base" AND $Scope <> "onelevel" AND $Scope <> "subtree" $Scope = "subtree" EndIf
    If VarType($What)>8192
        For Each $sF in $What $sGV=$sGV+'$'+'oRS.Fields("'+$sF+'").Value,' Next
        $sGV=Substr($sGV,1,Len($sGV)-1)
    Else
        $sGV='$'+'oRS.Fields("'+$What+'").Value'
    EndIf
    
    $oCon=CreateObject("ADODB.Connection")
    $oCon.Provider = "ADsDSOObject"
    ;$oCon.Properties("ADSI Flag").Value = 1
    If $User AND $Pswd
        $oCon.Properties("User ID").Value = $User
        $oCon.Properties("Password").Value = $Pswd
    EndIf
    $oCon.Open("Active Directory Provider")
     
    $oCMD = CreateObject("ADODB.Command")
    $oCMD.ActiveConnection = $oCon
    $oCMD.CommandText = "<"+$From+">;"+$Filter+";"+Iif(VarType($What)>8192,Join($What,','),$What)+";"+$Scope
    $oCMD.Properties("Page Size").Value=1000
    $oCMD.Properties("Timeout").Value=30
    $oCMD.Properties("Cache Results").Value=NOT 1
     
    $oRS = $oCMD.Execute
    If @ERROR Exit @ERROR EndIf
    If $oRS.BOF AND $oRS.EOF Exit @ERROR EndIf
     
    Do 
        $nul=Execute('$'+'vP='+$sGV)
        $aR[$R]=$vP
        $oRS.MoveNext
        $R=$R+1
        ReDim Preserve $aR[$R]
    Until $oRS.EOF
    ReDim Preserve $aR[$R-1]
    $fnLDAPQuery=$aR
EndFunction