Commands / Get-sqmADAccountStatus
Get-sqmADAccountStatus
Security sqmSQLTool v1.8.2+ · Active Directory 🛠 Pipeline-capable
Checks the status of one or more Active Directory user accounts: Enabled, LockedOut, PasswordExpired, and AccountExpired.

The function automatically uses the RSAT ActiveDirectory module if available (via Get-ADUser), or falls back to ADSI if RSAT is not installed. Useful for validating AD account health before SQL Server logins or permissions changes.

Parameters

ParameterTypeRequiredDefaultNotes
-SamAccountNamestring[]Required—One or more sAMAccountName values. Pipeline-capable.
-DomainControllerstringOptional—Target DC (RSAT path only). Ignored by ADSI fallback.

Execution Flow

START ActiveDirectory module available? YES Load RSAT useRSAT = $true NO foreach $sam in $SamAccountName (pipeline) useRSAT? YES Get-ADUser -Identity $sam NO ADSI Fallback: [adsisearcher](sAMAccountName=$sam) Read userAccountControl, lockoutTime, pwdLastSet, accountExpires, msDS-UserPasswordExpiryTimeComputed Decode account control flags and time attributes Enabled: Bit 0x0002 = disabled | LockedOut: Bit 0x0010 or lockoutTime > 0 PasswordExpired: Bit 0x800000 or compare msDS-attribute against now AccountExpired: convert accountExpires from FileTime, compare vs now Build [PSCustomObject] with status flags + Source (RSAT/ADSI) + QueryTime On error: ErrorMessage = exception text Return [PSCustomObject[]] with per-account status SamAccountName, Enabled, LockedOut, PasswordExpired, AccountExpired, Source, QueryTime, ErrorMessage DONE

Examples

Check a single AD user account
Get-sqmADAccountStatus -SamAccountName 'jdoe'
Pipeline: check multiple accounts
'jdoe','jsmith','awalker' | Get-sqmADAccountStatus
Check with specific domain controller (RSAT only)
Get-sqmADAccountStatus -SamAccountName 'jdoe' -DomainController 'DC01'
← Back
Command Index