How to lock Active Directory accounts programmatically?

Question

I have to lock user accounts in Active Directory programmatically in C#.

Unfortunately it doesn't work via the userAccountControl attribute. Every time I set userAccountControl to 528 (=normal account w/ lockout flag), Active Directory won't accept the value and resets it without further notice to 512 (=normal account).

Now I tried to lock the account by providing incorrect credentials (see below), but this doesn't work either.

int retries = 0;
while (!adsUser.IsAccountLocked && retries < MAX_LOCK_RETRIES)
{
     retries++;

    try
    {  
        new DirectoryEntry(userPath, logonName, incorrectPassword).RefreshCache();
    }
    catch (Exception)
    { /* ... */ }
    adsUser.GetInfo();
}

Any ideas?

Answer 1

Make sure the account you're using to disable the account has sufficient privileges to disable accounts. See this example from Microsoft.

Answer 2

Borrowed from http://www.codeproject.com/KB/system/everythingInAD.aspx

/// <summary>
/// Gets or sets a value indicating if the user account is locked out
/// </summary>
public bool IsLocked
{
    get { return Convert.ToBoolean(dEntry.InvokeGet("IsAccountLocked")); }
    set { dEntry.InvokeSet("IsAccountLocked", value); }
}

Answer 3

Guys, maybe you can help me out here...

I've seached the net all around, and maybe I'm too newbie to digest all I see...

That said, I'd need to find a way to check if an Active Directory UserAccount has his account locked or not.

I've tried userAccountControl property in a Windows 2000 AD but that property does not change a byte when I force an account to get locked (by trying to log on to a workstation providing the wrong password for that specific user) And I can tell by using ADExplorer.exe utility made by semi-god -> Mr. Russinovich (http://live.sysinternals.com/adexplorer.exe)

I've seen that in the 3.5 Framework they use the method .InvokeGet("userLockedOut"); but I'm trying to do this in a Enterprise Application that was written in .Net Framework 1.1 and there's no chance of using newer ones (just if you thought of suggesting so).

HELP!!!

Thanks A lot for your reply.

Regards!

Monoco Barrabia.