Unlock an Active Directory Account Using Mac OS X Directory Utility

Recent versions of OS X integrate well with Microsoft’s Active Directory. As an IT professional working in a primarily Windows-based environment, I can still perform most of my job just fine with a Macbook without resorting to Bootcamp or virtual machines. I do use Jump Desktop for remoting into servers to run Windows-only administrative tools though. One of those tools I frequently need to use is Active Directory Users and Computers. More and more though I’ve been using the native OS X Directory Utility to perform some of the tasks that I previously would have needed ADU&C for. This tool is more like the Active Directory Services Interface Editor (adsiedit.msc) than ADU&C because it presents you with all the attributes of an object without simple GUI buttons for common tasks. But that doesn’t mean it can’t be used for those tasks if you know how.

One common situation is unlocking a user’s account after too many invalid password attempts. To unlock an AD account using Directory Utility follow the steps below. Note: the screenshots below are redacted to hide any internal details of my workplace AD environment.

Launch Directory Utility(This handy app is hiding in /System/Library/CoreServices/Applications/)
Switch to the Directory Editor tab
Set the node to your domain rather than /Local/Default
Click the lock to authenticate with an account that has the necessary rights. This doesn’t need to be the same account you are currently logged in as.
Search for the user in question and then scroll down to the lockoutTime attribute. If this value is anything other than zero, the account is locked out.

Change the lockoutTime attribute to 0 and the user’s account is now unlocked.