GargoyleGargoyle
MM club member
Registered: 2004-03-09
Posts: 1597
Loc: Valley of the Sun (Arizona, US...
found it
Quote:
User lockout uses the user's lockoutTime property. When you access Active Directory by using the LDAP provider, you can use it to determine the lockout status of the user. If it is larger than zero, the user is currently locked out. To undo the lockout, set the value to zero.
LockoutTime is cleared only when the locked-out user attempts to log on. When the lockout time has expired, but the user has not yet tried to log on, lockoutTime may be still set, although the user would be able to successfully log on at that time.
GargoyleGargoyle
MM club member
Registered: 2004-03-09
Posts: 1597
Loc: Valley of the Sun (Arizona, US...
Well that is almost it... the .lockoutTime returns an object. How can I tell what can be accessed within that object? I am venturing into unknown waters here...
I have tried .lockoutTime.value and .lockoutTime.text, but get no value back from either of those
_________________________
Today is the tomorrow you worried about yesterday.
Glenn BarnasGlenn Barnas KiX Supporter
Registered: 2003-01-28
Posts: 4402
Loc: New Jersey
Here's a snippet that might help:
Code:
$Members = GroupMembers(@DOMAIN, 'Domain Users', 2)
For Each $Member In $Members
; get specific user data
$objUser = GetObject('WinNT://' + @DOMAIN + '/' +$Member + ',user')
; read flags
$Flags = $objUser.UserFlags
; if not disabled, and not Never Expires, report on expired or about to expire accounts
If Not $objUser.AccountDisabled And Not ($Flags & 65536)
$ExpDate = FixDate($objUser.PasswordExpirationDate)
$Days = Int(TimeDiff('Now', $ExpDate, 'D'))
$LStat = $objUser.IsAccountLocked
$EStat = $objUser.PasswordExpired
I think you're looking for the $LStat value above..
Glenn
_________________________ Actually I am a Rocket Scientist!
GargoyleGargoyle
MM club member
Registered: 2004-03-09
Posts: 1597
Loc: Valley of the Sun (Arizona, US...
Thanks Brad, but again they are using the WinNT provider. I was able to get the needed info with that. I was looking into using LDAP as the provider and instead of getting the "text value" I expected, I am getting an object back, and since I do not know what the members of that object are I am unable to read any of them.
What I ended up with was something like this
Code:
$usr = GetObject(WinNT://@domain/$user)
$lock = usr.IsAccountLocked
Select
Case $lock = 0
$Lbl_Locked.text = "Account is NOT locked"
Case $lock = -1
$lbl_Locked.text = "Account is locked"
Case 1
$lbl_Locked.text = "Error reading account lockout"
EndSelect
To "unlock" the account I have this code
Code:
$usr.IsAccountLocked = "FALSE"
$usr.setinfor
If @error = 0
$lbl_Locked.text = "Account has been unlocked"
Else
$lbl_Locked.text = "Error unlocking the account"
EndIf
What I found interesting is that everything that I have read so far says that this should be a "single value" in LDAP, when KiX reads the value it returns a Vartype of 9 (object). Hence why I have had so many problems. Like I stated it was easy enough to fix by changing the provider.
_________________________
Today is the tomorrow you worried about yesterday.
NTDOCNTDOC Administrator
Registered: 2000-07-28
Posts: 11634
Loc: Space
I've only briefly read the post Garg but remember that not everything that can be done with WINNT can be done with LDAP and vice-versa.
I would search the board some more as it could be one of those long 64bit integer issues or something like that.
I know the code has been done a couple of times here, but maybe as you've found they all use WinNT for it - not sure, just something more to ponder and research.
I was rewriting to go to WinNT, would still like to know how to get the "objects" available from a particular object handle.
