Selected Microsoft Windows 2003 Resource Kit Tools Readme

This document contains important information that is not included in Help for the Microsoft® Windows® Resource Kit Tools, including how to install the tools, along with important updates and corrections.

Contents

Individual Tool Release Notes

Acctinfo.dll: Additional Account Information Properties Page

Lockoutstatus.exe: Account Lockout Status

Individual Tool Release Notes

The following section includes information about individual Windows Resource Kit Tools that are not covered in Windows Resource Kit Tools Help (Rktools.chm).

Acctinfo.dll: Additional Account Information Properties Page

Acctinfo.dll is a dynamic link library that, when registered on a computer, adds a new property page (Additional Account Info) to the user object Properties dialog box in Active Directory Users and Computers. This new property page displays information such as the date when a user's password was last set, the date when a user's password will expire, and the dates and times when a user last logged on and logged off. This information is not typically available in Active Directory Users and Computers, for one of two reasons:

• In some cases, the information is not actually stored in Active Directory, but instead is calculated only when needed. For example, the date that a user's password will expire is not stored in Active Directory; instead, Active Directory stores the date that the password was last set and the maximum allowed password age (for example, passwords must be set every 60 days). To determine the actual date that a password expires, you typically have to use scripts to retrieve this information and calculate the expiration date. Acctinfo.dll performs these calculations for you.
• In some cases, information is stored locally rather than in Active Directory. For example, last logon and last logoff times are stored on each individual domain controller and are not replicated throughout the domain. Acctinfo.dll enables you to determine the last time a user logged on or logged off from a specified domain controller. If users are typically authenticated by the same domain controller, this will tell you when these users last logged on to or logged off from the domain. If users are authenticated by multiple domain controllers, you will need to install Acctinfo.dll on each of these servers and check the account information on each one.

Acctinfo.dll is primarily designed to report information about user passwords, account status, and logons. However, it also includes a mechanism for changing user passwords and for unlocking locked user accounts.

Concepts

Acctinfo.dll adds a custom property page to the user account object Properties dialog box in Active Directory Users and Computers. For more information about Active Directory Users and Computers, see Help and Support Center for Windows Server 2003.

System Requirements

The following are the system requirements for this tool:

• Windows Server 2003 or Windows 2000 Server operating system
• You must be an Administrator to install Acctinfo.dll.

File Required

• Acctinfo.dll

AcctInfo.dll Remarks

Installing Acctinfo.dll

To access the custom property page provided by Acctinfo.dll, you must first install and register the file Acctinfo.dll.

To install and register Acctinfo.dll

1. Copy the file Acctinfo.dll to the %windir%\system32 folder. In Windows Server 2003, this is typically C:\Windows\System32. In Windows 2000, this is typically C:\Winnt\System32.
2. Open a command window, and type the following (this example assumes that your %windir%\system32 folder is C:\Windows\System32):
   

   regsvr32 c:\windows\system32\acctinfo.dll

If the command is successful, a dialog box appears informing you that Acctinfo.dll has been registered.

Note

Acctinfo.dll must be registered on each computer on which Active Directory Users and Computers is used to access user account information. For example, suppose you have two servers (Server A and Server B) commonly used to display user account information. If you register Acctinfo.dll on Server A, the Additional Account Info property page will be available in Active Directory Users and Computers. However, this property page will not be available in Active Directory Users and Computers on Server B. To access this property page on Server B, you must register Acctinfo.dll on Server B.

Removing Acctinfo.dll

You can remove the Additional Account Info property page from Active Directory Users and Computers by uninstalling Acctinfo.dll. To uninstall Acctinfo.dll, open a command window, and type the following (this example assumes that your %windir%\system32 folder is C:\Windows\System32):

regsvr32 /u c:\windows\system32\acctinfo.dll

If the command is successful, the file Acctinfo.dll will be removed, and the Additional Account Info property page will no longer be visible in Active Directory Users and Computers. Note that this removes only the custom property page, and does not affect the data displayed on that page. This information (such as last logon and last logoff) can still be retrieved by other means.

Acctinfo.dll UI

Information retrieved by Acctinfo.dll must be viewed in Active Directory Users and Computers. To view information for a specified account, open Active Directory Users and Computers (either by using the Start menu or by typing dsa.msc in the Run dialog box). Locate and double-click the appropriate user account. In the Properties dialog box, click the Additional Account Info tab.

The Additional Account Info property page displays the following attribute values:

Additional Account Info Property Page

Modifying User Account Properties from the Additional Account Info Property Page

Although Acctinfo.dll is primarily designed to display information, it also allows you to perform two commonly required tasks: changing a user's password, and unlocking a locked user account.

Changing a User's Password

1. On the Additional Account Info property page, click Set PW On Site DC.
2. In the Change Password on a DC in the Users Site dialog box, type a new password in the Password and Confirm Password text boxes. Optionally, you can also select User Must Change Password At Next Logon. If selected, the user will be able to use their new password to logon to the domain, but will then be prompted to change their password.
3. Click OK.

You must have the right to reset user passwords for this operation to succeed. If you do not have this right, you will still be able to access the Change Password on a DC in the Users Site dialog box. However, after making the changes and clicking OK, an error message will be displayed, and the password will not be changed.

Unlocking a Locked User Account

1. On the Additional Account Info property page, click Set PW On Site DC.
2. In the Change Password on a DC in the Users Site dialog box, type a new password in the Password and Confirm Password text boxes. You cannot unlock a user account in this dialog box without setting a password as well.

   Caution

   You can select the Unlock Account check box by clicking both the Password and Confirm Password text boxes without typing anything. However, this will result in the user no longer having any password (because the two password boxes will be blank).

3. Select the Unlock Account check box.
4. Click OK.

Lockoutstatus.exe: Account Lockout Status

Overview

Account Lockout Status (LockoutStatus) is a combination command-line and GUI tool that displays lockout information about a particular user account. LockoutStatus collects information from every contactable domain controller in the target user account's domain.

File Required

• Lockoutstatus.exe

LockoutStatus Syntax

lockoutstatus {/u:DomainName\UserName | /u:UserName@DomainName} [/?]

DomainName

Target NetBIOS or DNS domain name

UserName

Target user name

LockoutStatus GUI

File Menu

The File menu allows the target user and domain to be changed. This menu also allows the output of LockoutStatus to be saved in text format.

View Menu

The View menu allows the user to view the status of the target users password. This menu also alows the user to refresh the main window of LockoutStatus.