How to determine if a local account is locked?

Question

Hi,&nbsp;Within minutes of searching, I was able to find the script below which determines if an Active Directory account is locked:&nbsp;Get-ADUser myaccount -Properties LockedOut | Select -Object LockedOut&nbsp;However, after almost 1.5 hours of searching, I can't find a script that will tell me if a&nbsp;local&nbsp;account is locked!&nbsp;Does anyone have a script for that?&nbsp;

animesh joshi · Answer

You can use win32_userAccount WMI class to do a remote query on a computer hosting the local account you want to get lockOut status of

get-wmiObject -class win32_userAccount -computerName <remote-computer> | where-object {$_.name -like 'localAcc1*'} | select-object -property status, lockOut, SID, disabled

kcmjr · Answer

bikhod&nbsp;Realizing this post is old, try this on the system itself...&nbsp;net user &lt;username&gt;&nbsp;The output can be parsed to check for a line stating "Account Active&nbsp; &nbsp; &nbsp; &nbsp;Yes"&nbsp;

vasilmichev · Answer

Locked has a different meaning in AD, compared to Azure AD (where it basically means "blocked"). So depending on which one you're after, check either the&nbsp;lockoutTime attribute or the relevant "bit" of the UserAccountControl attribute:&nbsp;https://support.microsoft.com/en-ca/help/305144/how-to-use-useraccountcontrol-to-manipulate-user-account-properties

bikhod · Answer

VasilMichev&nbsp;&nbsp;Thanks. I am using Windows Enterprise Server and not Azure.&nbsp;&nbsp;

bikhod · Answer

Animesh Joshi&nbsp;&nbsp;Thanks.&nbsp;I tried the below on the server but it just hangs.&nbsp; PDB0V is the server name and SSRS is a local account on that server.&nbsp;get-wmiObject -class win32_userAccount -computerName PDB0V| where-object {$_.name -like '*SSRS*'} | select-object -property status, lockOut, SID, disabled*

Forum Discussion

How to determine if a local account is locked?

7 Replies

Resources