AD user account control

Here is all what you must know about UserAccountcontrol attribute: https://www.it-connect.fr/active-directory-et-lattribut-useraccountcontrol/ Modify the useraccountcontrol in PowerShell: https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties?WT.mc_id=AZ-MVP-5004580 Indicateur de propriété Valeur hexadécimale Valeur en décimal SCRIPT 0x0001 1 ACCOUNTDISABLE 0x0002 2 HOMEDIR_REQUIRED 0x0008 8 LOCKOUT 0x0010 16 PASSWD_NOTREQD 0x0020 32 PASSWD_CANT_CHANGE 0x0040 64 ENCRYPTED_TEXT_PWD_ALLOWED 0x0080 128 TEMP_DUPLICATE_ACCOUNT 0x0100 256 NORMAL_ACCOUNT 0x0200 512 INTERDOMAIN_TRUST_ACCOUNT 0x0800 2048

AD – delegating account rights (user account control)

This site is not optimized for Internet Explorer version 8 or lower. Please upgrade to a modern browser. The question is “How do I delegate enabling and disabling Active Directory accounts?”. Unfortunately, these specific operations cannot be individually delegated. The flag that indicates whether a user is enabled or disabled is part of a bitmask

How to determine if an account is disabled by examining useraccountcontrol?

Reference: https://knowledge.zomers.eu/PowerShell/Pages/How-to-control-UserAccountControl-Active-Directory-flags-with-PowerShell.aspx For example to check if the user account is disabled (accountdisabled should be present, decimal value 2): ($user.UserAccountControl[0] -band 2) -ne 0   User account control values: Possible values An overview of the possible options and their equivalent numeric option are (source): Property flag Value in hexadecimal Value in decimal SCRIPT 0x0001 1