Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Active Directory up to 2008 network (our servers are a mix of 2008, 2003...)

I'm looking for a quick way to query AD to find out what users are locked out, preferably from a batch or script file, to monitor for possible issues with either user accounts being attacked by an automated attack or just anomalies in the network.

I've Googled and my Google-fu has failed; I found a query off Microsoft's own knowledgebase that cites a string to use on Server 2003 with the management snap-in's saved queries ( but when I entered it, the query returned 400 users that a spot-check showed did NOT have a checkmark in the "Account is locked out" box under "account." In fact, I don't see anything wrong with their accounts.

Is there a simple utility (wisesoft bulkadusers apparently uses this method behind the scenes, since it's results were also wrong) that will give a count of users and possibly their user object names? Script? Something?

share|improve this question
Have a look at my answer to this question:… – squillman Feb 4 '11 at 15:06
Unfortunately dsquery user -disabled is only for disabled accounts, not locked-out accounts. I don't see an option for locked-out. – mfinni Feb 4 '11 at 15:15
up vote 3 down vote accepted

You can use PowerShell and Quest tools.

You can just query all the AD user objects like this:

Get-QADUser -SizeLimit 0 | Where {$_.AccountIsLockedOut -eq "true"}

If you go this route, you could create ps1 files that are scheduled to run and you can export to these to a csv or even to a website - by using ConvertTo-Html then exporting it to a html file. For example:

Get-QADUser -SizeLimit 0 | Where {$_.AccountIsLockedOut -eq "true"} | Export-Csv c:\lockedoutusers.csv

or html:

Get-QADUser -SizeLimit 0 | Where {$_.AccountIsLockedOut -eq "true"} | CovertTo-Html > c:\lockedoutusers.html

Or if you wanted you could just throw it up on a gridview for an interactive view:

Get-QADUser -SizeLimit 0 | Where {$_.AccountIsLockedOut -eq "true"} | Out-GridView

share|improve this answer
Looking at the site, are the tools something that require a purchased tool first to use? They're all marked "compatible with only ARS 6.5.0" – Bart Silverstrim Feb 4 '11 at 15:43
the AD tools are definitely free, work on any standard win XP\7 powershell environment. – Jordan W. Feb 4 '11 at 16:12
@michaelburns-you have -sizelimkit in your examples, but it kept giving me an error until I used I'm wondering what it's doing...(/watches names scrolling by as it's "processing"...) – Bart Silverstrim Feb 4 '11 at 17:16
It seems to work! I locked out an account to test it and it found it and listed just that account...Yay! Not quite automated or easy to keep checking, but it seems to work for manual checks. – Bart Silverstrim Feb 4 '11 at 17:59
You can automate it, save the command with a ps1 ext. and just add it to scheduler and then have it run when you want. Check it when you want or add it to a website. – Michael Burns Feb 5 '11 at 3:48

You can also do this without 3rd party tool using the Active Directory module, as of PowerShell v2 and if you're on a 2008 domain:

get-aduser -filter * -properties * | where {$_.lockedout} | ft name,lockedout

then of course you can add Michael B's export pipes to this as well.

share|improve this answer
such a fan of the native commands! – Tim Alexander Oct 4 '11 at 15:31

I highly recommend Unlock by Joeware.

This command will show locked accounts:

unlock . * -view

And by removing the -view option you can also unlock them (all of them or one user at a time). Joe's tools are super reliable for me and are also very fast.

share|improve this answer
gotta love those joeware tools! – Jordan W. Feb 10 '11 at 22:55

I have had great success using the following "Saved Query" from within the AD snap-in.


To add this query, open up the AD MMC, Right click on "Saved Queries", select "New", "Query", then click "Define Query", under the drop-down select "Custom Search" and then "Advanced". Copy and paste the above query. You should now be able to unlock the locked out uses right from the query you just created.

You can find this and more from this technet wikipage.

share|improve this answer

In PowerShell: search-adaccount -lockedout | ft name, samaccountname

NB: Requires the PowerShell AD Module to be installed:

More info on search-adaccount here:

...and here:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.