lc. Identity Tools
Tools

userAccountControl calculator

Type a value to see which flags it carries, or tick flags to build one. The tool also gives you the LDAP filter and PowerShell query to find accounts with those bits set.

Processed locally, in your browser
Value
    Flags
    Find accounts with these flags

    Good to know

    • LOCKOUT and PASSWORD_EXPIRED are not kept up to date in userAccountControl. Read msDS-User-Account-Control-Computed or lockoutTime / pwdLastSet instead.
    • PASSWD_CANT_CHANGE is enforced by an ACE on the object, not by this bit: setting it alone does nothing.
    • The OID 1.2.840.113556.1.4.803 is the bitwise AND matching rule (all bits must be set); 1.2.840.113556.1.4.804 is bitwise OR (any bit).