[Samba] Account locked and delayed user data propagation...

Rowland penny rpenny at samba.org
Thu Dec 5 10:36:41 UTC 2019

On 05/12/2019 09:15, Andrew Bartlett via samba wrote:
> On Thu, 2019-12-05 at 09:44 +0100, Marco Gaiarin via samba wrote:
>> Mandi! Rowland penny via samba
>>    In chel di` si favelave...
>>> As I said, if 'lockoutTime' isn't set or it is set to '0', then the user
>>> isn't locked out, anything else and it is, but I do not believe that you can
>>> set it to anything else but '0' manually, only the system can do this.
>>> This is where 'lockoutDuration' comes in, the account should be unlocked
>>> when 'lockoutTime' + 'lockoutDuration' = NOW.
>>> However, you want to script (presumably when someone contacts you and
>>> screams 'I cannot log in') a way to unlock the user, the only way to do this
>>> is to set 'lockoutTime' to '0' regardless of what it is set to now.
>> Exactly. The function now appear as:
>> And finally seems to work. ;-)
> Also have a look at the msDS-User-Account-Control-Computed attribute.
> that will avoid you encoding this logic in your shell scripts as it is
> what Samba uses internally.
> Andrew Bartlett
It might be using it internally, but you cannot obtain it with an ldap 
search, it is system computed and as such isn't actually saved anywhere 
in AD.


More information about the samba mailing list