search for: uac_str

Quick addendum: I just stumbled upon abandoned accounts receiving "password expired" notifications forever, even if they get disabled subsequently (by me). It might be helpful to include this in the script: uAC_string=$(ldbsearch --url="${LDBDB}" -b "${domainDN}" -s sub "(&(objectCategory=person)(objectClass=user)(sAMAccountName=$user))" userAccountControl | grep userAccountControl: | sed "s|userAccountControl: ||") if [ "${uAC_string}" -eq "512&...

On Thu, 9 Feb 2017 14:56:47 +0100 Ole Traupe via samba <samba at lists.samba.org> wrote: > I only get the usernames: > Same on member servers, btw. Initially I thought this comes from > "winbind: use default domain", but this is neither present on my DCs > nor would it have any effect (afaik). This is what is confusing me, I know of no way to get the username

...lists.samba.org> wrote: > > You could always replace: > >> "(&(objectCategory=person)(objectClass=user)(sAMAccountName=$user))" >> userAccountControl | grep userAccountControl: | sed >> "s|userAccountControl: ||") >> >> if [ "${uAC_string}" -eq "512" ]; then >> >> [do expiration parsing] >> fi > With: > > "(&(objectCategory=person)(objectClass=user)(sAMAccountName=$user)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))" > > This will do the same ;-) > > Ro...