禁用Active Directory帐户的SQL查询

Question

我需要查询AD以确定是否禁用了用户帐户.

使用此处答案中使用的类似查询

SELECT *
FROM OPENQUERY(ADSI, 'SELECT sAMAccountName
FROM ''LDAP://DC=MyDC,DC=com,DC=uk''
WHERE objectCategory = ''Person''
AND objectClass = ''user'')

我相信确定帐户是否被禁用我必须以某种方式使用userAccountControl字段.我尝试了几件事,但它们似乎没有起作用:

WHERE userAccountControl & 2 <> 0

Answer 1

在OPENQUERY()内:

AND''userAccountControl:1.2.840.113556.1.4.803:''<> 2

SELECT *
FROM OPENQUERY(ADSI, 'SELECT sAMAccountName
FROM ''LDAP://DC=MyDC,DC=com,DC=uk''
WHERE objectCategory = ''Person''
AND objectClass = ''user''
AND ''userAccountControl:1.2.840.113556.1.4.803:''<>2)

Answer 2

怎么样:

SELECT sAMAccountName
FROM OPENQUERY(ADSI, 'SELECT sAMAccountName, userAccountControl 
FROM ''LDAP://DC=MyDC,DC=com,DC=uk'' 
WHERE objectCategory = ''Person'' 
AND objectClass = ''user''') 
WHERE userAccountControl & 2 <> 0; -- disabled

Answer 3

显然它确实有效...这将是 ID-10-T :p