Check user is locked in LDAP?

Question

I need to verify if the user account in the LDAP is locked I am using below code

const int ADS_UF_LOCKOUT = 0x00000010;
DirectoryEntry entry = new DirectoryEntry (_path, domainAndUsername, pwd);
if (((int)entry.Properties["useraccountcontrol"].Value & ADS_UF_LOCKOUT) == 1)
{
    return true;
}

But if the user account is locked , I am receiving , "Login Failed: Bad username /password"

Please Help.

Answer 1

If you want to determine if a user account is locked, then you can't use the user account information that you're checking for to determine this fact - because the user account is locked, you will be denied access.

You will not be told that the reason for being unable to log on is due to the account being locked, that would be considered excessive information disclosure.

If you want to determine if the reason for not being permitted to log on is due to the account being locked then you will need an already logged on account that can check the account lock state instead of trying from the failed connection.

Answer 2

You can use attribute lockout time for it too: it is 0 if user is not locked. (Connect to AD using administrator credentials).

DirectoryEntry _de = new DirectoryEntry (_path, domainAdmininstratorName, pwd); // get user as directory entry object
object largeInteger = _de.Properties["lockoutTime"].Value; // it's a large integer so we need to get it's value by a little bit complex way
long highPart =
            (Int32)
                largeInteger.GetType()
                    .InvokeMember("HighPart", BindingFlags.GetProperty, null, largeInteger, null);
long lowPart =
            (Int32)
                largeInteger.GetType()
                    .InvokeMember("LowPart", BindingFlags.GetProperty, null, largeInteger, null);
long result = (long) ((uint) lowPart + (((long) highPart) << 32));
if (result == 0) 
{
   // account is not locked
}
else
{
 // account is locked
}