Active Directory userAccountControl (UAC) Values

In Active Directory, every user and computer object has an attribute called userAccountControl (UAC). This attribute stores the sum of a set of bit flags that define the account’s state and behavior: whether the account is enabled, whether its password expires, whether it requires a smartcard, and so on — all of these settings are encoded into a single integer value.

The value is read using bitwise logic. For example, the “password never expires” flag (DONT_EXPIRE_PASSWORD = 65536) combined with “enabled normal account” (NORMAL_ACCOUNT = 512) produces 512 + 65536 = 66048. For this reason, when searching for accounts with a specific setting you use bit masking (-band) rather than equality.

Example: To find users configured so their password never expires, you can use the following PowerShell command.

Get-ADUser -Filter "useraccountcontrol -band 65536" -Properties userAccountControl |
    Select-Object Name, SamAccountName, userAccountControl

The -band 65536 expression returns every account with the DONT_EXPIRE_PASSWORD bit set, regardless of whether the account is enabled/disabled or carries other flags.

Default Values

Common Combined Values

The following table lists frequently encountered flag combinations and the account states they represent.

Individual Property Flags

Each flag represents a single bit. An account’s userAccountControl value is the sum of the individual values below.

Source

The flag names and values are based on Microsoft’s official documentation: How to use the UserAccountControl flags to manipulate user account properties.