[Samba] Account locked and delayed user data propagation...

[Rowland penny]

On 05/12/2019 09:15, Andrew Bartlett via samba wrote:
> On Thu, 2019-12-05 at 09:44 +0100, Marco Gaiarin via samba wrote:
>> Mandi! Rowland penny via samba
>>    In chel di` si favelave...
>>
>>> As I said, if 'lockoutTime' isn't set or it is set to '0', then the user
>>> isn't locked out, anything else and it is, but I do not believe that you can
>>> set it to anything else but '0' manually, only the system can do this.
>>> This is where 'lockoutDuration' comes in, the account should be unlocked
>>> when 'lockoutTime' + 'lockoutDuration' = NOW.
>>> However, you want to script (presumably when someone contacts you and
>>> screams 'I cannot log in') a way to unlock the user, the only way to do this
>>> is to set 'lockoutTime' to '0' regardless of what it is set to now.
>> Exactly. The function now appear as:
>>
>>
>> And finally seems to work. ;-)
> Also have a look at the msDS-User-Account-Control-Computed attribute.
> that will avoid you encoding this logic in your shell scripts as it is
> what Samba uses internally.
>
> Andrew Bartlett
>
It might be using it internally, but you cannot obtain it with an ldap 
search, it is system computed and as such isn't actually saved anywhere 
in AD.

Rowland