User Account Control Default Values

Question

I noticed that newly created accounts set the useraccountcontrol field to

{PASSWD_NOTREQD|NORMAL_ACCOUNT} = 0x220

rather than:

{NORMAL_ACCOUNT} = 0x200

Is there a place to alter this default setting?

Answer 1

Hello,

The PASSWD_NOTREQD flag is set when no password is specified for the new account. Active Directory doesn't allow user creation if the password is empty and this flag is not set.
To force users to specify passwords for new accounts, you can make the Password property required using Property Patterns.
For more details, please see Generate Initial Password on User Creation (on the 3rd step select the Password cannot be empty option).

See also: Set Default Account Options for New Users.

Comments

I doing something wrong. In our property patterns I've set the password to be required, and set it to a default value. I've also set the UserAccountControl to a default of "Normal", with the other options unchecked.

When I create an account, the password not required setting still appears, in addition to normal.

---

Make sure the Property Pattern affects the user.

1. Locate the newly created user in the Console Tree (Administration Console).
2. Right click the user, and click Properties in the context menu.
3. Activate the Effective Objects tab.
4. Click Property Patterns. Your Property Pattern must be in the list.

---

My property pattern is listed under the user's account properties, under the effective property patterns.

---

Please post a screenshot of your property pattern.

---

Another thing, If your property pattern is assigned over members of a group or Business Unit, it will not not be effective during user creation.

---

---

Is the property pattern assigned over All Objects?

---

Yes - sorry I cut that portion off earlier....

---

The other property patterns are enforced, just not the default account control values.

---

There are 2 possible reasons for why the password is not marked required:

1. You are creating the user not in the na.vul.com domain.
2. There is another property pattern that also applies to the Password property.

Can you please post a screenshot of the user creation form. Also, please click the

button for the Password property and post a screenshot of the the dialog that will open.

---

I uploaded our user creation form, along with the password property.

I went ahead and created a custom exe that is launched from a Business Rule that removes the PASSWD_NOTREQD Attribute from the useraccountcontrol field. It is applied every time a user account is created. This works for us and solves the issue.

It looks like this:
c:\utils\FixUserAccountControl.exe %sAMAccountName% %adm-InitiatorUserName%

---

It is possible to do it using the Update User Business Rule action.
Just add 'Update the User' action to your Business Rule, select the Account Options property in the list of available properties, and check all the options you need.

---

Judging by the screenshot you posted, the Property Pattern is applied correctly to the Password property and works as expected. Is the 'No Password Required' flag set after you create a user with a non-empty password?

---

Is the 'No Password Required' flag set after you create a user with a non-empty password? - Yes.

Also - I did try to remove the attribute via the Update User function and the user account control. This selector is disabled for the removal function (not the update).

For what it's worth - we are on AD 2003.

---

Is the 'No Password Required' flag set after you create a user with a non-empty password? - Yes.

Hmm, it looks like a bug. Our QA team will investigate it.

Also - I did try to remove the attribute via the Update User function and the user account control. This selector is disabled for the removal function (not the update).

Ah, of course. Sorry, my bad.
You can do it with the help of a PowerShell script:

Import-Module Adaxes

$userDN = "%distinguishedName%";
$userDomain = $Context.GetObjectDomain($userDN);
$ADS_UF_PASSWD_NOTREQD = 0x00000020;

$user = Get-AdmUser $userDN -Properties userAccountControl -Server $userDomain
$user.userAccountControl = $user.userAccountControl -band (-bnot($ADS_UF_PASSWD_NOTREQD));
Set-AdmUser $user -Server $userDomain

---

I just wanted to express my appreciation for your product and support. Both are outstanding and a pleasure to work with.

---

Thank you! :)

---

Hello,

Yesterday we released a new version of Adaxes (2012.1). Using the new version you can automatically update Account Options of user accounts using a special action - Modify Account Options:

• What's New in 2012.1
• Download