Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Still going through my LDAP database in my search for the wicked, I noticed a lot of accounts have sambaAcctFlags equal to [U], though the Samba docs says it should have 11 characters between [ and ] (and some actually do).

Is that a problem, or is 11 characters just an upper limit?


Just to be clear, many entries are like this:

sambaAcctFlags: [U          ]

But some are like this:

sambaAcctFlags: [U]

It is the later I'm concerned about.

share|improve this question

According to the passdb documentation on, the account flag field can contain up to 16 characters. Presently, only 11 are in use.

I can confirm that we've been using it in production for many years with accounts having just one flag.

share|improve this answer
Not much a question of having one flag, but of the field being filled with spaces to make up 11 characters or not. I hadn't noticed that section (I was looking up the field name), so that's +1. I don't feel, however, confident that there's a definitive answer. Sure, it works here, but that doesn't mean it may not cause subtle problems. – Daniel C. Sobral Nov 18 '10 at 12:12

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.