title: Why UserPrincipal.Enabled returns different values?
body: <p>I am trying to determine if a user account in AD is enabled. For this I use the following code:</p>
  
  <pre><code>string domain = "my domain";
  string group = "my security group";
  string ou = "my OU";
  
  //init context
  using (var cnt= new PrincipalContext(ContextType.Domain, domain))
  {
      //find the necessary security group
      using (GroupPrincipal mainGroup 
                = GroupPrincipal.FindByIdentity(cnt, IdentityType.Guid, group))
      {
          if (mainGroup != null)
          {
              //get the group's members
              foreach (var user in mainGroup.GetMembers()
                                     .OfType&lt;UserPrincipal&gt;()
                                     .Where(u =&gt; u.DistinguishedName.Contains(ou)))
              {
                  //ensure that all the info about the account is loaded
                  //by using FindByIdentity as opposed to GetMembers
                  var tmpUser= UserPrincipal.FindByIdentity(cnt, 
                                                            user.SamAccountName);
                  //actually I could use `user` variable, 
                  //as it gave the same result as `tmpUser`.
  
                  //print the account info
                  Console.WriteLine(tmpUser.Name + "\t" + 
                                    tmpUser.Enabled.HasValue + "\t" + 
                                    tmpUser.Enabled.Value);                    
              }
          }
      }
  }
  </code></pre>
  
  <p>The problem is, when I run this code under an administrative account, I get the real result, while when I run it under a non-priviledged account, <code>user.Enabled</code> returns <code>false</code> for some of the accounts, while it should be <code>true</code>.</p>
  
  <p>The only similar q&amp;a I managed to find are </p>
  
  <ol>
  <li><a href="http://social.msdn.microsoft.com/Forums/en-US/csharpgeneral/thread/939fdd80-7623-4db3-a166-645803610c48/" rel="nofollow noreferrer">UserPrincipal.Enabled returns False for accounts that are in fact enabled?</a> </li>
  <li><a href="http://www.codeproject.com/Articles/90142/Everything-in-Active-Directory-via-C-NET-3-5-Using" rel="nofollow noreferrer">Everything in Active Directory via C#.NET 3.5 (Using System.DirectoryServices.AccountManagement)</a> </li>
  </ol>
  
  <p>which do not help here.</p>
  
  <p>Why is that so? What are my options to get this info under a non-priviledged account?</p>
  
  <hr>
  
  <p>Here is another approach: <a href="https://stackoverflow.com/questions/2005637/how-to-determine-if-user-account-is-enabled-or-disabled">How to determine if user account is enabled or disabled</a>:</p>
  
  <pre><code>private bool IsActive(DirectoryEntry de)
  {
      if (de.NativeGuid == null) 
          return false;
  
      int flags = (int)de.Properties["userAccountControl"].Value;
  
      if (!Convert.ToBoolean(flags &amp; 0x0002)) 
          return true; 
      else 
          return false;
  }
  </code></pre>
  
  <p>Same approach is described in <a href="http://anyrest.wordpress.com/2010/02/01/active-directory-objects-and-c/" rel="nofollow noreferrer">Active Directory Objects and C#</a>.</p>
  
  <p>However when running under an unpriviledged user account, <code>userAccountControl</code> attribute is <code>null</code> and it's not possible to determine the state of the account.</p>
  
  <hr>
  
  <p>The workaround here is to use <a href="http://msdn.microsoft.com/en-us/library/bb341016.aspx" rel="nofollow noreferrer">PrincipalContext Constructor</a>, specifying the credentials of a user with enough priviledges to access AD. </p>
  
  <p>It stays unclear to me, why the unpriviledged user had access to AD at all, and couldn't get values of some certain account attributes. Probably this has nothing to do with C#, and should be configured in AD...</p>