Home / server / Questions / 34232
Accepted
Izzy
Asked: 2009-07-01 18:48:21 +0800 CST

Unlock AD User Account using DSMOD (command line)

  • 772

Just a quick question. I need to be able to unlock user accounts from the command line, NOT using NET USER loginname /DOMAIN /ACTIVE:YES

This is because our corporation lives across 4 domains, and the NET command is tied to the computer domain, with no way to specify alternative domains. Also, using ADUC is not an option for this specific case.

Basically, does DSMOD USER userDN -disabled no actually unlock an account? I can test this on Thursday, but wanted to know if I had to get in early to script the solution instead.

Cheers

active-directory windows-command-prompt

6 Answers

  1. Best Answer

    The answer is Yes.

    dsmod user userDN -disabled no

    This does unlock an account.

    • 7

  2. You can do an unlock/password Reset by SAM Name using this:

    dsquery user domainroot -samid %username%|dsmod user -disabled no -pwd %newpass% -mustchpwd yes
    • 4

  3. Unlock from joeware will do exactly this, as well as reporting currently locked accounts

    • 3

  4. If you're able to use vbscript, this should do the trick:

    Set objUser = GetObject ("LDAP://cn=user,ou=OrganisationalUnit,dc=test,dc=com")
objUser.IsAccountLocked = False
objUser.SetInfo

    Ehtyar.

    • 2

  5. The answer by @Akshi (which received a negative vote unfairly) should be the correct one - account disabled and LockedOut are two different things.

    Admins with the proper rights can Disable an account, using the wrong password too many times will Lock your account.

    Using Get-ADUser %username% -prop LockedOut in Power-Shell you can see the Enabled and the LockedOut attributes.

    dsmod user userDN -disabled no requires elevated admin privileges to work in most system setups, and I'm not sure it will unlock the account, I couldn't test it.

    Unlock-ADaccount username will work for most users with basic admin rights - worked for me.

    • 2

  6. i think you should use that command Unlock-ADaccount username

    hopefully this will help you

    • -1