uac Module

class uac.uac(value=0, ad_con=None, objectguid=None)[source]

Bases: object

An interface to work with userAccountControl flags.

Constants:

ADS_UF_ACCOUNTDISABLE = 2

The user account is disabled.

ADS_UF_DONT_EXPIRE_PASSWD = 65536

The password for this account will never expire.

ADS_UF_DONT_REQUIRE_PREAUTH = 4194304

This account does not require Kerberos pre-authentication for logon.

ADS_UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED = 128

The user can send an encrypted password.

ADS_UF_HOMEDIR_REQUIRED = 8

The home directory is required.

ADS_UF_INTERDOMAIN_TRUST_ACCOUNT = 2048

This is a permit to trust account for a system domain that trusts other domains.

ADS_UF_LOCKOUT = 16

The account is currently locked out.

ADS_UF_MNS_LOGON_ACCOUNT = 131072

This is an MNS logon account.

ADS_UF_NORMAL_ACCOUNT = 512

This is a default account type that represents a typical user.

ADS_UF_NOT_DELEGATED = 1048576

The security context of the user will not be delegated to a service even if the service account is set as trusted for Kerberos delegation.

ADS_UF_PASSWD_CANT_CHANGE = 64

The user cannot change the password. Note You cannot assign the permission settings of PASSWD_CANT_CHANGE by directly modifying the UserAccountControl attribute. For more information and a code example that shows how to prevent a user from changing the password, see User Cannot Change Password. (http://msdn.microsoft.com/en-us/library/aa746508(v=vs.85).aspx )

ADS_UF_PASSWD_NOTREQD = 32

No password is required.

ADS_UF_PASSWORD_EXPIRED = 8388608

The user password has expired. This flag is created by the system using data from the Pwd-Last-Set attribute and the domain policy.

ADS_UF_SCRIPT = 1

The logon script is executed.

ADS_UF_SERVER_TRUST_ACCOUNT = 8192

This is a computer account for a system backup domain controller that is a member of this domain.

ADS_UF_SMARTCARD_REQUIRED = 262144

The user must log on using a smart card.

ADS_UF_TEMP_DUPLICATE_ACCOUNT = 256

This is an account for users whose primary account is in another domain. This account provides user access to this domain, but not to any domain that trusts this domain. Also known as a local user account.

ADS_UF_TRUSTED_FOR_DELEGATION = 524288

The service account (user or computer account), under which a service runs, is trusted for Kerberos delegation. Any such service can impersonate a client requesting the service.

ADS_UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION = 16777216

The account is enabled for delegation. This is a security-sensitive setting; accounts with this option enabled should be strictly controlled. This setting enables a service running under the account to assume a client identity and authenticate as that user to other remote servers on the network.

ADS_UF_USE_DES_KEY_ONLY = 2097152

Restrict this principal to use only Data Encryption Standard (DES) encryption types for keys.

ADS_UF_WORKSTATION_TRUST_ACCOUNT = 4096

This is a computer account for a computer that is a member of this domain.

commit()[source]

Commit changes back to the self.objectguid object.

classmethod flags(value)[source]

iterate through flags (using dir()) and return a human-legible rendition of account flags.

>>> someUacObject.flags()
['ADS_UF_DONT_EXPIRE_PASSWD', 'ADS_UF_NORMAL_ACCOUNT']
instance_flags()[source]
Returns:a list of user-readable flags which are set. 
>>> someUacObject.flags()
['ADS_UF_DONT_EXPIRE_PASSWD', 'ADS_UF_NORMAL_ACCOUNT']
is_set(flag)[source]

Check if a specified flag is set.

Returns:Boolean
set(flag)[source]

Set a UAC flag

Example:
>>> someUacObject.set(uac.ADS_UF_PASSWORD_EXPIRED).commit()
Returns:Self so that calls may be chained.
uac_value = 0

Default value (0)

unset(flag)[source]

Use AND to unset a flag.

>>> someUacObject.set(uac.ADS_UF_PASSWORD_EXPIRED).commit()
Returns:Self so that calls may be chained.