userAccountControl decoder
Paste an Active Directory userAccountControl value (decimal or hex) to see its flags, or a 4720 / 4738 event to see which account
flags were changed. Flag names and descriptions are Microsoft's; flags that weaken an account are pointed out. Everything runs in your browser.
Try:
userAccountControl calculator
Tick flags to get the value, for an LDAP filter or a Set-ADUser script.
Value: 0 (0x0)
Common userAccountControl values
Each row is decoded from Microsoft's flag table on this page; nothing in it is typed by hand.
| Value | Hex | Flags | What it is |
|---|---|---|---|
| 512 | 0x200 | NORMAL_ACCOUNT | User account, enabled, Microsoft's default for: typical user |
| 514 | 0x202 | ACCOUNTDISABLE + NORMAL_ACCOUNT | User account, disabled |
| 544 | 0x220 | PASSWD_NOTREQD + NORMAL_ACCOUNT | User account, enabled |
| 546 | 0x222 | ACCOUNTDISABLE + PASSWD_NOTREQD + NORMAL_ACCOUNT | User account, disabled |
| 66048 | 0x10200 | NORMAL_ACCOUNT + DONT_EXPIRE_PASSWORD | User account, enabled |
| 66050 | 0x10202 | ACCOUNTDISABLE + NORMAL_ACCOUNT + DONT_EXPIRE_PASSWORD | User account, disabled |
| 66080 | 0x10220 | PASSWD_NOTREQD + NORMAL_ACCOUNT + DONT_EXPIRE_PASSWORD | User account, enabled |
| 66082 | 0x10222 | ACCOUNTDISABLE + PASSWD_NOTREQD + NORMAL_ACCOUNT + DONT_EXPIRE_PASSWORD | User account, disabled |
| 4096 | 0x1000 | WORKSTATION_TRUST_ACCOUNT | Computer account, enabled, Microsoft's default for: workstation/server |
| 4128 | 0x1020 | PASSWD_NOTREQD + WORKSTATION_TRUST_ACCOUNT | Computer account, enabled |
| 532480 | 0x82000 | SERVER_TRUST_ACCOUNT + TRUSTED_FOR_DELEGATION | Domain controller account, enabled, Microsoft's default for: domain controller |
| 590336 | 0x90200 | NORMAL_ACCOUNT + DONT_EXPIRE_PASSWORD + TRUSTED_FOR_DELEGATION | User account, enabled · security-relevant |
| 4260352 | 0x410200 | NORMAL_ACCOUNT + DONT_EXPIRE_PASSWORD + DONT_REQ_PREAUTH | User account, enabled · security-relevant |
| 2080 | 0x820 | PASSWD_NOTREQD + INTERDOMAIN_TRUST_ACCOUNT | Trust account, enabled, Microsoft's default for: trust |
All userAccountControl flags
| Flag | Decimal | Hex | Microsoft's description |
|---|---|---|---|
| SCRIPT | 1 | 0x0001 | The logon script will be run. |
| ACCOUNTDISABLE | 2 | 0x0002 | The user account is disabled. |
| HOMEDIR_REQUIRED | 8 | 0x0008 | The home folder is required. |
| LOCKOUT | 16 | 0x0010 | — |
| PASSWD_NOTREQD | 32 | 0x0020 | No password is required. |
| PASSWD_CANT_CHANGE | 64 | 0x0040 | The user can't change the password. It's a permission on the user's object. For information about how to programmatically set this permission, see Modifying User Cannot Change Password (LDAP Provider).You can't assign this permission by directly modifying the UserAccountControl attribute. |
| ENCRYPTED_TEXT_PWD_ALLOWED | 128 | 0x0080 | The user can send an encrypted password. |
| TEMP_DUPLICATE_ACCOUNT | 256 | 0x0100 | It's an account for users whose primary account is in another domain. This account provides user access to this domain, but not to any domain that trusts this domain. It's sometimes referred to as a local user account. |
| NORMAL_ACCOUNT | 512 | 0x0200 | It's a default account type that represents a typical user. |
| INTERDOMAIN_TRUST_ACCOUNT | 2048 | 0x0800 | It's a permit to trust an account for a system domain that trusts other domains. |
| WORKSTATION_TRUST_ACCOUNT | 4096 | 0x1000 | It's a computer account for a computer that is running Microsoft Windows NT 4.0 Workstation, Microsoft Windows NT 4.0 Server, Microsoft Windows 2000 Professional, or Windows 2000 Server and is a member of this domain. |
| SERVER_TRUST_ACCOUNT | 8192 | 0x2000 | It's a computer account for a domain controller that is a member of this domain. |
| DONT_EXPIRE_PASSWORD | 65536 | 0x10000 | Represents the password, which should never expire on the account. |
| MNS_LOGON_ACCOUNT | 131072 | 0x20000 | It's an MNS logon account. |
| SMARTCARD_REQUIRED | 262144 | 0x40000 | When this flag is set, it forces the user to log on by using a smart card. |
| TRUSTED_FOR_DELEGATION | 524288 | 0x80000 | When this flag is set, the service account (the user or computer account) under which a service runs is trusted for Kerberos delegation. Any such service can impersonate a client requesting the service. To enable a service for Kerberos delegation, you must set this flag on the userAccountControl property of the service account. |
| NOT_DELEGATED | 1048576 | 0x100000 | When this flag is set, the security context of the user isn't delegated to a service even if the service account is set as trusted for Kerberos delegation. |
| USE_DES_KEY_ONLY | 2097152 | 0x200000 | (Windows 2000/Windows Server 2003) Restrict this principal to use only Data Encryption Standard (DES) encryption types for keys. |
| DONT_REQ_PREAUTH | 4194304 | 0x400000 | (Windows 2000/Windows Server 2003) This account doesn't require Kerberos pre-authentication for logging on. |
| PASSWORD_EXPIRED | 8388608 | 0x800000 | (Windows 2000/Windows Server 2003) The user's password has expired. |
| TRUSTED_TO_AUTH_FOR_DELEGATION | 16777216 | 0x1000000 | (Windows 2000/Windows Server 2003) The account is enabled for delegation. It's a security-sensitive setting. Accounts that have this option enabled should be tightly controlled. This setting lets a service that runs under the account assume a client's identity and authenticate as that user to other remote servers on the network. |
| PARTIAL_SECRETS_ACCOUNT | 67108864 | 0x04000000 | (Windows Server 2008/Windows Server 2008 R2) The account is a read-only domain controller (RODC). It's a security-sensitive setting. Removing this setting from an RODC compromises security on that server. |
Source: Microsoft, Use the UserAccountControl flags to manipulate user account properties. Defaults Microsoft lists: typical user512, domain controller532480, workstation/server4096, trust2080.
The UAC values in events 4720 and 4738 are different numbers
When an account is created (event 4720) or changed (event 4738),
Windows logs Old UAC Value and New UAC Value. Microsoft: these contain "the value of the SAM implementation of account flags
(definition differs from userAccountControl in AD)". The same account that AD stores as 66048 appears in the event as 0x210.
The User Account Control line then lists one %% code per changed flag; this tool decodes both.
| SAM flag | Value | Turned on | Turned off | [MS-SAMR] description |
|---|---|---|---|---|
| USER_ACCOUNT_DISABLED | 0x1 | %%2080 | %%2048 | Specifies that the account is not enabled for authentication. |
| USER_HOME_DIRECTORY_REQUIRED | 0x2 | %%2081 | %%2049 | Specifies that the homeDirectory attribute is required. |
| USER_PASSWORD_NOT_REQUIRED'Password Not Required' | 0x4 | %%2082 | %%2050 | Specifies that the password-length policy does not apply to this user. |
| USER_TEMP_DUPLICATE_ACCOUNT | 0x8 | %%2083 | %%2051 | This bit is ignored by clients and servers. |
| USER_NORMAL_ACCOUNT'Normal Account' | 0x10 | %%2084 | %%2052 | Specifies that the user is not a computer object. |
| USER_MNS_LOGON_ACCOUNT | 0x20 | %%2085 | %%2053 | This bit is ignored by clients and servers. |
| USER_INTERDOMAIN_TRUST_ACCOUNT | 0x40 | %%2086 | %%2054 | Specifies that the object represents a trust object. For more information about trust objects, see [MS-LSAD]. |
| USER_WORKSTATION_TRUST_ACCOUNT | 0x80 | %%2087 | %%2055 | Specifies that the object is a member workstation or server. |
| USER_SERVER_TRUST_ACCOUNT'Server Trust Account' | 0x100 | %%2088 | %%2056 | Specifies that the object is a DC. |
| USER_DONT_EXPIRE_PASSWORD'Don't Expire Password' | 0x200 | %%2089 | %%2057 | Specifies that the maximum-password-age policy does not apply to this user. |
| USER_ACCOUNT_AUTO_LOCKED | 0x400 | %%2090 | %%2058 | Specifies that the account has been locked out. |
| USER_ENCRYPTED_TEXT_PASSWORD_ALLOWED'Encrypted Text Password Allowed' | 0x800 | %%2091 | %%2059 | Specifies that the cleartext password is to be persisted. |
| USER_SMARTCARD_REQUIRED'Smartcard Required' | 0x1000 | %%2092 | %%2060 | Specifies that the user can authenticate only with a smart card. |
| USER_TRUSTED_FOR_DELEGATION'Trusted For Delegation' | 0x2000 | %%2093 | %%2061 | This bit is used by the Kerberos protocol. It indicates that the "OK as Delegate" ticket flag (described in [RFC4120] section 2.8) is to be set. |
| USER_NOT_DELEGATED'Not Delegated' | 0x4000 | %%2094 | %%2062 | This bit is used by the Kerberos protocol. It indicates that the ticket-granting tickets (TGTs) of this account and the service tickets obtained by this account are not marked as forwardable or proxiable when the forwardable or proxiable ticket flags are requested. For more information, see [RFC4120]. |
| USER_USE_DES_KEY_ONLY'Use DES Key Only' | 0x8000 | %%2095 | %%2063 | This bit is used by the Kerberos protocol. It indicates that only des-cbc-md5 or des-cbc-crc keys (as defined in [RFC3961]) are used in the Kerberos protocol for this account. |
| USER_DONT_REQUIRE_PREAUTH'Don't Require Preauth' | 0x10000 | %%2096 | %%2064 | This bit is used by the Kerberos protocol. It indicates that the account is not required to present valid pre-authentication data, as described in [RFC4120] section 7.5.2. |
| USER_PASSWORD_EXPIRED | 0x20000 | %%2097 | %%2065 | Specifies that the password age on the user has exceeded the maximum password age policy. |
| USER_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION'Trusted To Authenticate For Delegation' | 0x40000 | %%2098 | %%2066 | This bit is used by the Kerberos protocol, as specified in [MS-KILE] section 3.3.1.1. |
| USER_NO_AUTH_DATA_REQUIRED | 0x80000 | %%2099 | %%2067 | This bit is used by the Kerberos protocol. It indicates that when the key distribution center (KDC) is issuing a service ticket for this account, the privilege attribute certificate (PAC) is not to be included. For more information, see [RFC4120]. |
| USER_PARTIAL_SECRETS_ACCOUNT | 0x100000 | %%2100 | %%2068 | Specifies that the object is a read-only domain controller (RODC). |
| USER_USE_AES_KEYS | 0x200000 | %%2101 | %%2069 | This bit is ignored by clients and servers. |
Sources: [MS-SAMR] 2.2.1.12 USER_ACCOUNT Codes. The %% codes follow Microsoft's two documented examples, which this page's tests reproduce: 4720 (0x0 → 0x15: %%2080 %%2082 %%2084) and 4738 (0x15 → 0x211: %%2050 %%2089).
Finding risky flags in Active Directory
LDAP's bitwise filter (1.2.840.113556.1.4.803, "bit AND") finds accounts with a flag set. With PowerShell's ActiveDirectory module:
# Kerberos pre-authentication not required (AS-REP roastable)
Get-ADUser -LDAPFilter '(userAccountControl:1.2.840.113556.1.4.803:=4194304)' -Properties userAccountControl
# Unconstrained delegation on accounts that are not domain controllers
Get-ADObject -LDAPFilter '(&(userAccountControl:1.2.840.113556.1.4.803:=524288)(!(userAccountControl:1.2.840.113556.1.4.803:=8192)))'
# Password not required
Get-ADUser -LDAPFilter '(userAccountControl:1.2.840.113556.1.4.803:=32)' -Properties userAccountControlAnd the changes as they happen, in Microsoft Sentinel: %%2096 is 'Don't Require Preauth' turned on, %%2093 'Trusted For Delegation' and %%2082 'Password Not Required':
SecurityEvent
| where EventID == 4738
| where EventData has "%%2096" or EventData has "%%2093" or EventData has "%%2082"
| project TimeGenerated, Computer, TargetAccount, SubjectAccount, EventDataQuestions
- What does userAccountControl 514 mean?
- 514 is 512 + 2: NORMAL_ACCOUNT (a typical user) with ACCOUNTDISABLE set, so the user account is disabled. 512 is the same account enabled, which Microsoft lists as the default value for a typical user.
- What is userAccountControl 66048?
- 66048 (0x10200) is NORMAL_ACCOUNT (512) + DONT_EXPIRE_PASSWORD (65536): an enabled user whose password never expires. 66050 is the same account disabled. Microsoft recommends monitoring this flag for critical accounts, or all accounts if your organization does not allow it.
- Why do 544 and 546 appear on new accounts?
- 544 is NORMAL_ACCOUNT + PASSWD_NOTREQD (32), and 546 adds ACCOUNTDISABLE. PASSWD_NOTREQD means the password-length policy does not apply to the account, so it may have an empty password. Microsoft says it should not typically be enabled for user accounts.
- Why does event 4738 show 0x210 when AD says 66048?
- The Old UAC Value and New UAC Value of events 4720 and 4738 are the SAM account flags ([MS-SAMR] USER_ACCOUNT codes), not the AD userAccountControl attribute, and the two use different bits: in SAM, normal account is 0x10 and password never expires is 0x200, so 0x210 is the same account AD stores as 66048. Paste the whole event to decode it with the right table.
- What do %%2080 and %%2089 mean in a 4738 event?
- The User Account Control field lists one code per changed flag. In Microsoft’s own examples, %%2080 + n means SAM flag bit n was turned on and %%2048 + n that it was turned off: %%2084 is ‘Normal Account’ – Enabled, %%2089 ‘Don’t Expire Password’ – Enabled and %%2050 ‘Password Not Required’ – Disabled.
- Which flags are a security risk?
- DONT_REQ_PREAUTH (4194304) lets anyone request a crackable ticket for the account (AS-REP roasting). TRUSTED_FOR_DELEGATION (524288) on anything but a domain controller is unconstrained delegation. PASSWD_NOTREQD (32), ENCRYPTED_TEXT_PWD_ALLOWED (128) and USE_DES_KEY_ONLY (2097152) weaken the password or Kerberos keys.
Investigating an account change?
Load the Security log into the free analyzer: new accounts and additions to privileged groups are flagged, with the failed and successful logons around them. Nothing is uploaded.
Investigating something right now? LogTriage checks every address in the file against threat intelligence and writes the incident report: 10 analyses a month free. The incident pack adds the in-depth AI analysis and files up to 100 MB: 25 analyses for $19, one payment, no subscription. Pricing
Every query on this site's reference pages, the Sigma rules and a cheat sheet in one download: the Incident Response Kit, $29 once.