Admin Tips
- Windows Server 2008/2003/2000/XP/NT Administrator Knowledge Base
  - Windows NT
    - Admin Tips
      - Accounts
        Find All Locked-Out Accounts

Section(s): Accounts, Active Directory , Admin , TroubleShooting
Published on May 12, 2005.
Last Modified on May 12, 2005.
Last Modified by Mitch Tulloch.
Rated 4.2 out of 5 based on 62 votes.

Use Saved Queries to quickly locate all locked out user accounts.

You can use the Saved Queries feature of Windows Server 2003 to query Active Directory for any locked-out accounts. Just open the Active Directory Users and Computers console, right-click on Saved Queries in the console tree and select New --> Query. Type a name and description for the query, specify a query root (where in your namespace your query begins searching), and click the Define Query button. Since there's no default option for finding locked-out accounts in the Common Queries box, select Custom Search instead to open the Find Custom Search box. Then select the Advanced tab and enter the following LDAP string in the Enter LDAP Query textbox:

(&(&(&(objectCategory=person)(objectClass=user)(lockoutTime:1.2.840.113556.1.4.804:=4294967295))))

Click OK twice to create and run the saved query.

The string works on Windows Server 2003 SP1.

Update: Here's another LDAP query that finds all locked out accounts:

(&(objectCategory=Person)(objectClass=User)(lockoutTime>=1))

About Mitch Tulloch

Mitch Tulloch was lead author for the Windows Vista Resource Kit from Microsoft Press, which is the book for IT pros who want to deploy, maintain and support Windows Vista in mid- and large-sized network environments. Mitch was also the author of Introducing Windows Server 2008 and technical project lead for the Microsoft Office Communications Server 2007 Resource Kit, both books also from Microsoft Press. For more information on these and other books by Mitch, see www.mtit.com .