PowerShell在ActiveDirectory中檢查鎖定的用戶

Question

您是否知道如果可能以及如何在不安裝ActiveDirectory模塊的情況下檢查用戶是否鎖定在ActiveDirectory中？在機器上安裝東西是有限制的，我想知道是否可以使用另一個函數，與Get-ADUser不同。 謝謝！

Answer 1

看dsquery，即CMD，但可以從Powershell的被稱爲https://technet.microsoft.com/en-us/library/cc732952.aspx

Answer 2

是這樣的：

$sAMAccountName = "testuser" 
$ADS_UF_LOCKOUT = 16  
$Attribute = "msds-user-account-control-computed"  
$ADSearcher = New-Object System.DirectoryServices.DirectorySearcher 
$ADSearcher.PageSize = 1000 
$ADSearcher.Filter = "samaccountname=$sAMAccountName" 
$User = $ADSearcher.FindOne()  
$MyUser = $User.GetDirectoryEntry() 
$MyUser.RefreshCache($Attribute)  
$UserAccountFlag = $MyUser.Properties[$Attribute].Value  
if ($UserAccountFlag -band $ADS_UF_LOCKOUT) 
{ 
Write-host "Account $sAMAccountName is locked" 
} 
else 
{ 
Write-host "Account $sAMAccountName isn't locked" 
}