dc=tools
Type a value to see its flags, or tick flags to build one. Each result comes with the matching-rule filter that finds it. Everything runs in your browser, so nothing you paste leaves your machine. The page's Content-Security-Policy also stops it from sending anything, which you can check in its source.
Type a value to see its flags, or tick flags to build one.
Three flags are never stored in the attribute, so a filter on them matches nothing. For lockouts, filter on (lockoutTime>=1), which also catches lockouts that have since expired. Expired passwords show in msDS-User-Account-Control-Computed, which you can read but not filter on. "Can't change password" is a permission on the account, not a flag.