Retour
-
Titre
HOW TO: Create a Managed Unit or Dynamic Group to gather all users who have "Password Never Expires" set to TRUE -
Description
How is is possible to create a Managed Unit, Dynamic Group, or search query that shows all users who have Password Never Expires (edsaPasswordNeverExpires) set to TRUE?
-
Cause
It is expected that no computed attributes can be used to create a Managed Unit or Dynamic Group. Instead, it is necessary to build the Managed Unit or Dynamic Group by querying the native Active Directory setting. -
Résolution
Active Directory stores this setting as a userAccountControl bitwise hash. This can be queried using the following LDAP string:
(&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=65536))
NOTE: The :1.2.840.113556.1.4.803: is a special LDAP OID which is also known as LDAP_MATCHING_RULE_BIT_AND
For more information on the userAccountControl attribute, see this Microsoft resource.
Active Roles has a built-in operator for this conditional which is called Bitwise ANDTo turn this query into a Managed Unit:
- In the Active Roles Console, as an Active Roles Admin, navigate to Configuration | Managed Units
- Create a new Managed Unit or modify an existing Managed Unit with an Include by Query membership rule
- Set the Find dropdown in the top left to Users and then click on the Advanced tab
- Click on the Field button and select the userAccountControl attribute
- Set the Condition to Bitwise AND and the Value to 65536
- Click on Add Rule and the OK
