title: Check if a UserPrincipal is enabled
body: <p>I'm using C# code to query an Active Directory. The main issue I'm having is determining whether an account has been disabled or not. Looking through many online articles, it would appear that one cannot solely rely on the property UserPrincipal.Enabled to determine if a user account is enabled or not. Fair enough, as its a nullable Boolean but when an AD administrator disables an account, this does appear to get set to false. The problem I have is when I query a client's AD, I find that most user accounts UserPrincipal objects return false for this property. So when I use this code to check if an account is disabled:</p>
  
  <pre><code>private bool IsUserEnabled(UserPrincipal userPrincipal)
  {
          bool isEnabled = true;
  
          if (userPrincipal.AccountExpirationDate != null)
          {
              // Check the expiration date is not passed.
              if (userPrincipal.AccountExpirationDate &lt;= DateTime.Now)
              {
                  Log.DebugFormat("User {0} account has expired on {1}", userPrincipal.DisplayName, userPrincipal.AccountExpirationDate.Value);
                  isEnabled = false;
              }
          }
  
          if (userPrincipal.IsAccountLockedOut())
          {
              isEnabled = false;
              Log.DebugFormat("User {0} account is locked out", userPrincipal.DisplayName);
          }
  
          if (userPrincipal.Enabled != null)
          {
              isEnabled = userPrincipal.Enabled.Value;
              Log.DebugFormat("User {0} account is Enabled is set to {1}", userPrincipal.DisplayName, userPrincipal.Enabled.Value);
          }
  
          return isEnabled;
  }
  </code></pre>
  
  <p>Most accounts appear disabled because of the <code>userPrincipal.Enabled</code> check.</p>
  
  <p>However, if I leave this out and just rely on the account expiration date and the account lockout properties, then I may miss someone who is disabled using the checkbox in Active Directory which simply disables the account - without setting the account expiration date.</p>
  
  <p>All the accounts where enabled returns false are actually active accounts who can log in to the domain.</p>
  
  <p>How do you check if an account is actually enabled or not?</p>