ActiveDirectory module has clever logic that calculate "popular" properties like whether a user account is
Enabled or have
PasswordNeverExpires set and presents them like regular attributes.
Internally, they're derived from actual account attributes like
userAccountControl is a bitfield, and contains a long list of account security related settings, like "User cannot change password" and account "Disabled".
Microsoft's LDAP implementation let's you filter such an attribute with bitwise operators, identified by an Object Identifier (OID):
LDAP_MATCHING_RULE_BIT_OR : 1.2.840.113518.104.22.1684
Disabled accounts, we can use the following filter syntax:
As always, you can negate an ldap expression with
!, in this example retrieving all
Likewise, a setting called
DONT_EXPIRE_PASSWORD has value 65536 (0x10000), and we can find these accounts with:
Calculating password expiration is a bit more complicated. To aid developers and integrators, Microsoft has implemented a dynamic attribute named
msDS-User-Account-Control-Computed transparently returns the same value as
userAccountControl, but with the addition of the following bits, computed on the fly at lookup time:
I haven't tested this, but if memory serves me right, this should help you
reliably identify accounts with expired passwords with this filter:
Unfortunately you cannot use contructed attributes in LDAP query filters, so what you'll have to do is filter on the first two statements:
Be sure to ask the directory server for the
msDS-User-Account-Control-Computed value, and then perform your bitwise AND mask on the results, client-side.