Skip to content

userAccountControl 590336: User, password never expires, trusted for delegation

userAccountControl Decoder: Decode Active Directory userAccountControl values (512, 514, 66048, 532480) into flags, see what each means and how to set it, or build one.

Active Directory keeps an account's switches (disabled, password never expires, trusted for delegation…) as bits added up in its userAccountControl attribute: 66048 is 65536 + 512. Type a value from ADSI Edit, Get-ADUser -Properties userAccountControl or a security report to see which flags it holds, what each means and how to change it, or tick flags below to build one. Flag names and values are from Microsoft's UserAccountControl property flags.

Try: 512, 514, 66048, 532480, 4096, 590336

User, password never expires, trusted for delegation

590336 = 0x90200 = 512 + 65536 + 524288

ValueFlagMeaning
512
0x200		 NORMAL_ACCOUNT An ordinary user account.
Every user has it; 512 alone is a plain, enabled user.
65536
0x10000		 DONT_EXPIRE_PASSWORD The password never expires.
Common on service accounts; a group Managed Service Account (gMSA) is the better answer there.
Active Directory Users and Computers: "Password never expires"
PowerShell: Set-ADAccountControl -PasswordNeverExpires $true
524288
0x80000		 TRUSTED_FOR_DELEGATION
review
 Unconstrained delegation: services on this account can act as any user who signs in to them, anywhere.
Normal on domain controllers; on anything else it's a well-known attack path. Prefer constrained or resource-based delegation.
Active Directory Users and Computers: "Trust this user/computer for delegation to any service (Kerberos only)"
PowerShell: Set-ADAccountControl -TrustedForDelegation $true

Find accounts like this

Exactly this valueGet-ADObject -LDAPFilter "(userAccountControl=590336)" -Properties userAccountControl
Users with these flagsGet-ADUser -LDAPFilter "(userAccountControl:1.2.840.113556.1.4.803:=589824)"
LDAP filter(userAccountControl:1.2.840.113556.1.4.803:=589824)
1.2.840.113556.1.4.803 is LDAP's bitwise AND rule: it matches accounts that have at least these bits, whatever else is set.

Change it: tick flags to build a new value

IncludeValueFlagMeaning
1 Run the logon script. Kept for old clients; the scriptPath attribute is what matters today.
2 The account is disabled and can't sign in.
8 A home folder is required.
16 The account is locked out.
32 The account may have an empty password, whatever the password policy says.
64 The user can't change their own password.
128 The password is stored with reversible encryption, close to plain text.
256 A local account for a user whose main account is in another domain (pre-Windows 2000 domains).
512 An ordinary user account.
2048 The account a domain uses for a trust with another domain.
4096 A computer account: a workstation or a member server.
8192 A domain controller's computer account.
65536 The password never expires.
131072 A Majority Node Set (cluster) logon account.
262144 Interactive sign-in needs a smart card.
524288 Unconstrained delegation: services on this account can act as any user who signs in to them, anywhere.
1048576 The account can't be delegated by any service, even one trusted for delegation.
2097152 Kerberos may use only DES keys for this account.
4194304 Kerberos pre-authentication isn't required.
8388608 The password has expired.
16777216 Constrained delegation with protocol transition: the account can get tickets as a user to the services it's allowed to, without that user's password.
67108864 A read-only domain controller (RODC) computer account.