Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Just a quick question. I need to be able to unlock user accounts from the command line, NOT using NET USER loginname /DOMAIN /ACTIVE:YES

This is because our corporation lives across 4 domains, and the NET command is tied to the computer domain, with no way to specify alternative domains. Also, using ADUC is not an option for this specific case.

Basically, does DSMOD USER userDN -disabled no actually unlock an account? I can test this on Thursday, but wanted to know if I had to get in early to script the solution instead.


share|improve this question
up vote 5 down vote accepted

The answer is Yes.

dsmod user userDN -disabled no

This does unlock an account.

share|improve this answer

You can do an unlock/password Reset by SAM Name using this:

dsquery user domainroot -samid %username%|dsmod user -disabled no -pwd %newpass% -mustchpwd yes
share|improve this answer

Unlock from joeware will do exactly this, as well as reporting currently locked accounts

share|improve this answer
Ideally I'd like to use native tools - adding 3rd party executables into the equation if it can be done with native tools doesn't really tie in with Best Practices – Izzy Jul 1 '09 at 3:49
Dude, it's joeware though! smile (Yeah-- having to use 3rd party tools is fairly annoying, though.) – Evan Anderson Jul 1 '09 at 3:56
So what if it is third-party. It does the job quickly and easily. I have used joeware tools to automate admin tasks and it has worked really well. – benPearce Jul 1 '09 at 4:35
I operate in an extremely tight, cSOX throttled, 8 audits a year corporate environment. The paperwork I have to put in to get this approved just isn't worth it :) I could, probably will have to, script this out in VBS in no time on Thursday - was just hoping to use native tools. PS. I'm actually a developer too - I had to be, because it's easier to write my OWN tools and executables, than it is to get 3rd party tools through the approval process. Insane eh? That's the Oil/Gas/Coal/Energy industry for you – Izzy Jul 1 '09 at 15:23
I can see your point, sucks though! Stupid thing is that probably no one is auditing your code so it is a bit of a half-arsed approach from the auditing perspective. You could rename the tools to iexplore.exe :-) – benPearce Jul 1 '09 at 22:08

If you're able to use vbscript, this should do the trick:

Set objUser = GetObject ("LDAP://cn=user,ou=OrganisationalUnit,dc=test,dc=com")
objUser.IsAccountLocked = False


share|improve this answer
That's the scripting route I was going to go down, but was hoping to go down the DSMOD route. – Izzy Jul 1 '09 at 3:46
I also had trouble finding anything on the dsmod route during my searches. I found this whilst frantically trying to find something that might make up for my earlier screw-up. I have a tendency to favor script based solutions myself because you not only see exactly how it works, but you can modify it and include it in other scripting endevours later, but that's just me. – Ehtyar Jul 1 '09 at 5:57
I'll test the "DSMOD -disabled no" on Thursday and see what happens. I have no problem scripting or coding by the way :) – Izzy Jul 1 '09 at 15:25

i think you should use that command Unlock-ADaccount username

hopefully this will help you

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.