Question

What is the prefered way to lock an Active Directory account?

int val = (int)directoryentry.Properties["userAccountControl"].Value;
directoryentry.Properties["userAccountControl"].Value = val | 0x0010;

vs.

directoryentry.InvokeSet("IsAccountLocked", true); 

Is there a better way?

Answer 1

Are you on .NET 3.5 (or can you upgrade to it)??

If so, check out the new System.DirectoryServices.AccountManagement namespace and all it has to offer! Excellent intro is the MSDN article Managing Directory Security Principals in the .NET Framework 3.5.

For your case, you’d have to get hold of a UserPrincipal some way, e.g.

PrincipalContext ctx = new PrincipalContext(ContextType.Domain, "YOURDOMAIN");
UserPrincipal me = UserPrincipal.Current;

and then you have access to a plethora of really easy to use properties and methods – e.g.:

bool isLockedOut = me.IsAccountLockedOut();

and you can unlock a locked account using:

me.UnlockAccount();

MUCH easier than the plain old System.DirectoryServices stuff!