4

I would like to know if and how is it possible to know if an AD user can log in interactively (on a server) in a Windows domain.

I need to know if I can find it out using an LDAP search.

  • The answers mentioned about the interactive policy, however maybe your query is more about „not blocked, not expired and not disabled“? In that case using a bind with the User Account should help you for those kinds of AD flags. – eckes Jan 28 at 21:26
5

An LDAP search is not enough, because the ability to perform an interactive logon is controlled by the security policy in the destination computer.

The policy itself ("Allow Interactive Logon") can be managed by Group Policies in the domain (which you can check using RSOP, but not using LDAP), but it can also be manually configured on any given computer; also, the rights to perform an interactive logon can be assigned to users or groups, which further complicate things.

In short, there are multiple settings involved to define who is allowed to log on where; there is no quick, easy and general way to answer your question; even RSOP can only help a little here, because it can only check domain policies, not local ones.

4

Strictly through LDAP? No, this is not possible. Group Policy settings on the server can control if an account can log in, and those policies are not accessible via LDAP.

4

This is not an LDAP search - well - not directly - and there are various settings that come into play.

This setting is controlled either by a GPO or the local security policy.

See LOCAL SECURITY POLICY => Local Policies

Further this comes into play, 2.1.1 Interactive Logon Authentication:

Users can perform an interactive logon by using a local user account for local logon or a domain account for domain logon. The interactive logon process confirms the user's identification by using the security account database on the user's local computer or by using the domain's directory service. This mandatory logon process cannot be turned off for users in a domain.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.