UserAccountControl Attribute Explained

2.9K

The userAccountControl attribute contains a set of flags that define the status of a user account in Active Directory.

How to view userAccountControl value?

The userAccountControl value can be viewed in the Active Directory Users and Computers (ADUC) graphical snap-in.

1. Open the user properties and go to the Attribute Editor tab.
2. Find the userAccountControl attribute.
3. This displays the attribute value in hexadecimal, as well as a set of enabled flags indicating the account’s status in AD. For example, 0x200 = (NORMAL_ACCOUNT).

   

4. When you open this attribute, its value is displayed in decimal.

The value of the userAccountControl attribute is determined by the set of AD user options enabled on the Account tab. Each of the highlighted attributes on the tab is a bit (flag). It can take the value 1 (true) or 0 (false). All of these values are part of a single userAccountControl attribute, rather than being stored as separate attributes of the AD user.

For example, if you enable the Password never expires option here, the value of the userAccountControl attribute changes to 0x10200 (NORMAL_ACCOUNT |DONT_EXPIRE_PASSWD) or 66048 in decimal.

The UserAccountControl attribute is a 32-bit (4-byte) bitwise mask, where each account parameter is one bit of the mask. The value of the userAccountControl attribute is the sum of the values ​​of the enabled account status flags.

List of possible account status flags

The following table lists the possible flags and their values:

HEX	DEC	NAME
0x0001	1	SCRIPT
0x0002	2	ACCOUNTDISABLE
0x0008	8	HOMEDIR_REQUIRED
0x0010	16	LOCKOUT
0x0020	32	PASSWD_NOTREQD
0x0040	64	PASSWD_CANT_CHANGE
0x0080	128	ENCRYPTED_TEXT_PWD_ALLOWED
0x0100	256	TEMP_DUPLICATE_ACCOUNT
0x0200	512	NORMAL_ACCOUNT
0x0800	2048	INTERDOMAIN_TRUST_ACCOUNT
0x1000	4096	WORKSTATION_TRUST_ACCOUNT
0x2000	8192	SERVER_TRUST_ACCOUNT
0x10000	65536	DONT_EXPIRE_PASSWORD
0x20000	131072	MNS_LOGON_ACCOUNT
0x40000	262144	SMARTCARD_REQUIRED
0x80000	524288	TRUSTED_FOR_DELEGATION
0x82000	532480	Domain controller
0x100000	1048576	NOT_DELEGATED
0x200000	2097152	USE_DES_KEY_ONLY
0x400000	4194304	DONT_REQ_PREAUTH
0x800000	8388608	PASSWORD_EXPIRED
0x1000000	16777216	TRUSTED_TO_AUTH_FOR_DELEGATION
0x04000000	67108864	PARTIAL_SECRETS_ACCOUNT

In this example, the value 66048 is the result of the sum of the following flags: NORMAL_ACCOUNT (512) +DONT_EXPIRE_PASSWORD (65536) = 512+65536=66048

For example, a disabled AD user account has an attribute value of 514:ACCOUNTDISABLE (2) + NORMAL_ACCOUNT (512)

Get the userAccountControl value with PowerShell

You can use the Get-ADUser PowerShell cmdlet to get the userAccountControl value:

Get-ADUser b.jackson -Properties * | select Name,userAccountControl

For example, to list all domain users with a password that never expires, use the following command with an LDAP query:

Get-ADUser -Filter {userAccountControl -band 65536} -Properties userAccountControl |
Select Name, userAccountControl

Note. You should use the -band operator to check specific flags in userAccountControl, since it is a bitmask attribute.

Changing the value of userAccountControl attribute

Administrators can change the value of the userAccountControl attribute from the ADUC snap-in by enabling or disabling flags on the Account tab.

Important. Note that we don’t recommend you a direct modification of the `userAccountControl` attribute unless you fully understand all bit flags involved.

In case of incorrect changes, it may unintentionally:

• Disable user accounts
• Remove password restrictions
• Break authentication/login behavior
• Affect trust/computer account configuration

It is also possible to change individual account control settings using PowerShell. For example, to disable a user account, use the Disable-ADAccount cmdlet:

Disable-ADAccount -Identity b.jackson

Alternatively, you can use Set-ADAccountControl with the -Enabled parameter:

Set-ADAccountControl -Identity b.jackson -Enabled $false

For a typical user account, disabling the account results in a userAccountControl value of 514 (NORMAL_ACCOUNT + ACCOUNTDISABLE). You should generally use Disable-ADAccount or Set-ADAccountControl rather than directly replacing the entire userAccountControl attribute.

The AD PowerShell module also has a built-in cmdlet, Set-ADAccountControl, that can be used to change the individual userAccountControl flags:

Set-ADAccountControl b.jackson -PasswordNotRequired $false -PasswordNeverExpires $true -CannotChangePassword $true

Convert value of userAccountControl into human readable form

In order to convert the value of userAccountControl into a human readable form, you can use the online service UAC-Decoder. Paste the attribute’s decimal value and the service will return a list of enabled account flags.

PowerShell script to find attributes of AD user

You can also use a PowerShell script to find the attributes of an AD user that are enabled:

$UACvalue = 66048

$flags = @{
0x0001 = 'SCRIPT'
0x0002 = 'ACCOUNTDISABLE'
0x0008 = 'HOMEDIR_REQUIRED'
0x0010 = 'LOCKOUT'
0x0020 = 'PASSWD_NOTREQD'
0x0040 = 'PASSWD_CANT_CHANGE'
0x0080 = 'ENCRYPTED_TEXT_PWD_ALLOWED'
0x0100 = 'TEMP_DUPLICATE_ACCOUNT'
0x0200 = 'NORMAL_ACCOUNT'
0x0800 = 'INTERDOMAIN_TRUST_ACCOUNT'
0x1000 = 'WORKSTATION_TRUST_ACCOUNT'
0x2000 = 'SERVER_TRUST_ACCOUNT'
0x10000 = 'DONT_EXPIRE_PASSWORD'
0x20000 = 'MNS_LOGON_ACCOUNT'
0x40000 = 'SMARTCARD_REQUIRED'
0x80000 = 'TRUSTED_FOR_DELEGATION'
0x100000 = 'NOT_DELEGATED'
0x200000 = 'USE_DES_KEY_ONLY'
0x400000 = 'DONT_REQ_PREAUTH'
0x800000 = 'PASSWORD_EXPIRED'
0x1000000 = 'TRUSTED_TO_AUTH_FOR_DELEGATION'
0x4000000 = 'PARTIAL_SECRETS_ACCOUNT'
}

foreach ($flag in $flags.GetEnumerator()) {
if ($UACvalue -band $flag.Key) {
$flag.Value
}
}