Lock Active Directory accounts programmatically

Question

I have to lock user accounts in Active Directory programmatically in C#.

Unfortunately it doesn't work via the userAccountControl attribute. Every time I set userAccountControl to 528 (=normal account w/ lockout flag), Active Directory won't accept the value and resets it without further notice to 512 (=normal account).

Now I tried to lock the account by providing incorrect credentials (see below), but this doesn't work either.

int retries = 0;
while (!adsUser.IsAccountLocked && retries < MAX_LOCK_RETRIES)
{
     retries++;

    try
    {  
        new DirectoryEntry(userPath, logonName, incorrectPassword).RefreshCache();
    }
    catch (Exception)
    { 
        /* ... */ 
    }
    adsUser.GetInfo();
}

Any ideas?

Answer 1

Make sure the account you're using to disable the account has sufficient privileges to disable accounts. See this example from Microsoft.