title: Cannot enable active directory user using net-ldap
body: <p>We're experiencing an issue trying to enable a active directory user(<code>windows server 2012 r2</code>) using the <code>net/ldap</code> library.</p>
  
  <h2>Setup</h2>
  
  <p>First, we create a user via this method:</p>
  
  <pre><code>def create_user(attrs)
    dn = "cn=#{attrs[:cn]},cn=Users,#{@base}"
    cn = attrs[:cn]
    pass = ascii_convert(attrs[:pwd])
    updated_attrs = { cn: cn,
                      objectclass: ['user'],
                      samaccountname: cn,
                      userprincipalname: "#{attrs[:cn]}@#{@domain}",
                      unicodepwd: pass
    }
  
    @connection.add(dn: dn, attributes: updated_attrs)
    result = @connection.get_operation_result
    raise LdapError.new("Create AD user error: #{result}") if result.code   != 0
  end
  </code></pre>
  
  <p>This creates the user, and by default sets their <code>userAccountControl</code> attribute to <code>546</code> (which is what we want), when inspected in active directory this shows as:</p>
  
  <p><code>0x222 (ACCOUNTDISABLE|PASSWD_NOTREQD|NORMAL_ACCOUNT)</code>.</p>
  
  <h2>Problem</h2>
  
  <p>Later we want to enable that user so we call:</p>
  
  <pre><code>def enable_user!(dn, cn)
    u = search_query(find_user(cn)).try(:first)
    if u
      @connection.replace_attribute(dn, :useraccountcontrol, '512')
    else
      false
    end
  end
  </code></pre>
  
  <p>However, if I print <code>@connection.get_operation_result</code> I get:</p>
  
  <p><code>&lt;OpenStruct code=53, error_message="0000052D: SvcErr: DSID-031A12D2, problem 5003 (WILL_NOT_PERFORM), data 0\n\u0000", matched_dn="", message="Unwilling to perform"&gt;</code></p>
  
  <p>With this method we want the <code>userAccountControl</code> to equal <code>512</code>, which is the equivalent of <code>0x200 (NORMAL_ACCOUNT)</code>.</p>
  
  <h2>Things I've Tried</h2>
  
  <p>notes: connection is over SSL (LDAPS), and bound to an admin AD account.</p>
  
  <ul>
  <li><a href="https://stackoverflow.com/questions/5349593/how-to-modify-useraccountcontrol-in-activedirectory-from-rubyonrails3-with-ruby1">this answer</a> </li>
  <li>using <code>#modify</code> instead of <code>#replace_attribute</code> in the <code>enable_user!</code> method.</li>
  <li>passing the hex values instead of the integer representation.</li>
  <li>perform the same modification using apache directory studio.</li>
  </ul>
  
  <p>One interesting thing I did notice, is that I can modify <code>useraccountcontrol</code> to <code>514</code> which is:</p>
  
  <p><code>0x202 (ACCOUNTDISABLE|NORMAL_ACCOUNT)</code></p>
  
  <p>So, it seems I can modify this attribute as long as it's remaining disabled, as soon as I try to change to enabled is when I see the error.</p>