Inconsistent behavior with AccountExpires field

Question

Hello Adaxes team,

We experienced a problem this week-end with a scheduled task that rely on AccountExpires field.
It check the property in that way :
if 'Account Expires' property is less than equal to '%datetime,+2d%' then .....

The goal is to disable account when expiration date is over for two days. Of course i don't want account with no expiration date to be included. So i checked this task with few accounts first with no problem.
And this weekend many accounts with no expiration date had been disabled !

The problem is that according to MSDN, the AccountExpires property can be either 0 or 0x7FFFFFFFFFFFFFFF if there is no expiration.
And it seems that Adaxes handles correctly 0x7FFFFFFFFFFFFFFF value but not 0.
It's obviously a problem for me as the comparison is quite explicit and we have no way in AD to set 0 or 0x7FFFFFFFFFFFFFFF explicitely when using standard admin tools (and i still don't understand why there is two different values for the same thing but that's another story).

That should be corrected in my opinion, i'm waiting for yours

Regards

Stephen

Answer 1

Hello Stephen,

In order to check the expiration date of a user account, I suggest you use the If account/password <expiration status> condition:

Comments

Mmmm yes it makes sense in my particular example.

But what if i want to make complex validation such as expiration date between two dates (if accountExpires gt Date + 1 month and lt Date + 2 month) ?
In that case, i'm stuck with that right ? And i will encounter the same issue.

Thanks for your help

---

Stephen,

If the If account/password <expiration status> condition doesn't work for you, and you want to check the account expiration date, you need to add If the 'Account Expires' property does not equal 'unspecified' condition:

2012.1 will introduce the Script Condition that can be used for complex scenarios.

---

I missed that. Thanks !