SQL query for locked Active Directory accounts

Question

I need to query AD to determine if the user account is disabled.

Using a similar query used in answers here

SELECT *
FROM OPENQUERY(ADSI, 'SELECT sAMAccountName
FROM ''LDAP://DC=MyDC,DC=com,DC=uk''
WHERE objectCategory = ''Person''
AND objectClass = ''user'')

I believe that to determine if the account is disabled, I need to somehow use the userAccountControl field. I tried a few things, but they don't seem to work:

WHERE userAccountControl & 2 <> 0

Answer 1

Apparently this worked ... it will be ID-10-T: p

Answer 2

Inside OPENQUERY ():

And `` userAccountControl: 1.2.840.113556.1.4.803: '' <> 2

SELECT *
FROM OPENQUERY(ADSI, 'SELECT sAMAccountName
FROM ''LDAP://DC=MyDC,DC=com,DC=uk''
WHERE objectCategory = ''Person''
AND objectClass = ''user''
AND ''userAccountControl:1.2.840.113556.1.4.803:''<>2)

Answer 3

:

SELECT sAMAccountName
FROM OPENQUERY(ADSI, 'SELECT sAMAccountName, userAccountControl 
FROM ''LDAP://DC=MyDC,DC=com,DC=uk'' 
WHERE objectCategory = ''Person'' 
AND objectClass = ''user''') 
WHERE userAccountControl & 2 <> 0; -- disabled