UserAccountControl Attribute/Flag Values

UserAccountControl is one of the most important attributes of user and computer accounts in Active Directory. This attribute determines the status of the account in the AD domain: whether the account is active or locked, whether the option of password change at the next logon is enabled, whether users can change their passwords, etc. However, not all administrators are fully aware of how and for what purpose UserAccountControl attribute is used in AD.

Open the properties of any AD account in the Active Directory Users and Computers (ADUC) console and go to the Accounttab. Please, pay attention to the group of user attributes in the Account Options section. Here you can see the following options:

• User must change password at next logon;
• User cannot change password;
• Password never expires;
• Store password using reversible encryption;
• Account is disabled;
• Smart card is required for interactive logon;
• Account is sensitive and cannot be delegated;
• Use Kerberos DES encryption types for this account;
• This account supports Kerberos AES 128/256 bit encryption;
• Do not require Kerberos Preauthentication.

The table of available flags of AD accounts is given below. Each flag corresponds to a certain UserAccountControl bit, and UserAccountControl value equals to the sum of all flags.

Property flag descriptions (Copied from KB Article)

• SCRIPT – The logon script will be run.
• ACCOUNTDISABLE – The user account is disabled.
• HOMEDIR_REQUIRED – The home folder is required.
• PASSWD_NOTREQD – No password is required.
• PASSWD_CANT_CHANGE – The user cannot change the password. This is a permission on the user’s object. For information about how to programmatically set this permission.
• ENCRYPTED_TEXT_PASSWORD_ALLOWED – The user can send an encrypted password.
• TEMP_DUPLICATE_ACCOUNT – This is an account for users whose primary account is in another domain. This account provides user access to this domain, but not to any domain that trusts this domain. This is sometimes referred to as a local user account.
• NORMAL_ACCOUNT – This is a default account type that represents a typical user.
• INTERDOMAIN_TRUST_ACCOUNT – This is a permit to trust an account for a system domain that trusts other domains.
• WORKSTATION_TRUST_ACCOUNT – This is a computer account for a computer that is running Microsoft Windows NT 4.0 Workstation, Microsoft Windows NT 4.0 Server, Microsoft Windows 2000 Professional, or Windows 2000 Server and is a member of this domain.
• SERVER_TRUST_ACCOUNT – This is a computer account for a domain controller that is a member of this domain.
• DONT_EXPIRE_PASSWD – Represents the password, which should never expire on the account.
• MNS_LOGON_ACCOUNT – This is an MNS logon account.
• SMARTCARD_REQUIRED – When this flag is set, it forces the user to log on by using a smart card.
• TRUSTED_FOR_DELEGATION – When this flag is set, the service account (the user or computer account) under which a service runs is trusted for Kerberos delegation. Any such service can impersonate a client requesting the service. To enable a service for Kerberos delegation, you must set this flag on the userAccountControl property of the service account.
• NOT_DELEGATED – When this flag is set, the security context of the user is not delegated to a service even if the service account is set as trusted for Kerberos delegation.
• USE_DES_KEY_ONLY – (Windows 2000/Windows Server 2003) Restrict this principal to use only Data Encryption Standard (DES) encryption types for keys.
• DONT_REQUIRE_PREAUTH – (Windows 2000/Windows Server 2003) This account does not require Kerberos pre-authentication for logging on.
• PASSWORD_EXPIRED – (Windows 2000/Windows Server 2003) The user’s password has expired.
• TRUSTED_TO_AUTH_FOR_DELEGATION – (Windows 2000/Windows Server 2003) The account is enabled for delegation. This is a security-sensitive setting. Accounts that have this option enabled should be tightly controlled. This setting lets a service that runs under the account assume a client’s identity and authenticate as that user to other remote servers on the network.
• PARTIAL_SECRETS_ACCOUNT – (Windows Server 2008/Windows Server 2008 R2) The account is a read-only domain controller (RODC). This is a security-sensitive setting. Removing this setting from an RODC compromises security on that server.

UserAccountControl values

These are the default UserAccountControl values for the certain objects:

• Typical user : 0x200 (512)
• Domain controller : 0x82000 (532480)
• Workstation/server: 0x1000 (4096)

So, that’s all in this blog. I will meet you soon with next stuff .Have a nice day !!!

Recommended content

• RODC Installation Guide- Step by step guide to install read only domain controller
• RODC Filtered Attribute Set
• Installing and configuring a RODC in Windows Server-2012
• How to find the GUID of Domain Controller
• Group Policy Understanding Group Policy Preferences
• Group Policy Verification Tool GPOTool Exe
• Group Policy Health Check on Specific Domain Controller

Guys please don’t forget to like and share the post. You can also share the feedback on below windows techno email id.

If you have any questions feel free to contact us on admin@windowstechno.com also follow us on facebook@windowstechno to get updates about new blog posts.