What is UAC Value in Active Directory?

In Active Directory (AD), every user account has an attribute called UserAccountControl (UAC). This value is a numeric (integer) field that determines the status and behavior of the account.

The UAC value is not a simple number, but rather a bitwise combination of flags. Each flag represents a specific property or restriction of the account. For example, one bit may indicate whether the account is active, another may signal that the password never expires, and another may require smart card authentication. By adding these flags together, Active Directory generates a unique UAC value for each account.

Why is UAC important?

Security: Helps administrators identify disabled accounts, expired passwords, or accounts with weak security configurations.

Management: Allows bulk management of accounts (e.g., disabling multiple accounts).

Troubleshooting: Quickly shows if an account is locked, expired, or misconfigured.

Common Values:

512 (NORMAL_ACCOUNT): Standard, active account.

514 (ACCOUNTDISABLE): Disabled account.

544: Normal account that does not require a password.

66048: Password expired.

8388608: Password never expires.

Example in PowerShell:

Get-ADUser -Identity username -Properties userAccountControl | Select-Object Name, userAccountControl


This command retrieves the UAC value for a given user. The numeric value must then be interpreted using the flag definitions.

In summary, the UAC value is a powerful indicator of how a user account functions in Active Directory and is essential for maintaining both security and operational efficiency.