title: Active Directory (LDAP) - Check account locked out / Password expired
body: <p>Currently I authenticate users against some AD using the following code:</p>
  
  <pre><code>DirectoryEntry entry = new DirectoryEntry(_path, username, pwd);
  
  try
  {
      // Bind to the native AdsObject to force authentication.
      Object obj = entry.NativeObject;
  
      DirectorySearcher search = new DirectorySearcher(entry) { Filter = "(sAMAccountName=" + username + ")" };
      search.PropertiesToLoad.Add("cn");
      SearchResult result = search.FindOne();
      if (result == null)
      {
          return false;
      }
      // Update the new path to the user in the directory
      _path = result.Path;
      _filterAttribute = (String)result.Properties["cn"][0];
  }
  catch (Exception ex)
  {
      throw new Exception("Error authenticating user. " + ex.Message);
  }
  </code></pre>
  
  <p>This works perfectly for validating a password against a username.</p>
  
  <p>The problem comes in that a generic errors is always returned "Logon failure: unknown user name or bad password." when authentication fails.</p>
  
  <p>However authentication might also fail when an account is locked out.</p>
  
  <p>How would I know if it is failing because of it being locked out?</p>
  
  <p>I've come across articles saying you can use:</p>
  
  <pre><code>Convert.ToBoolean(entry.InvokeGet("IsAccountLocked"))
  </code></pre>
  
  <p>or do something like explained <a href="http://en.csharp-online.net/User_Management_with_Active_Directory%E2%80%94Determining_Account_Lockout" rel="noreferrer">here</a></p>
  
  <p>The problem is, whenever you try to access any property on the DirectoryEntry, the same error would be thrown.</p>
  
  <p>Any other suggestion of how to get to the actual reason that authentication failed?  (account locked out / password expired / etc.)</p>
  
  <p>The AD I connect to might not neccesarily be a windows server.</p>