For some reason, Apple is great at just changing the syntax or path of (insert random feature here). And thus, I'm having trouble disabling (not locking a account, that seems to work fine by setting pwdLastSet to 0) which should disable the user from logging in.

The reason being is that i'm creating a scenario where:

  • User tries to login 3 times -> Gets locked out
  • A script running in the background unlocks the account after 30min or so

In between or even after the system adminitrator has a neat button to disable accounts and it shouldn't just lock out the accounts because that would sort of defeat the purpose of the script and the whole locked-out mechanism but rather disable the account all togeather rendering the users account invalid for logins even if the correct password is supplied and the account is unlocked/never locked in the first place.

Is this possible? and where do i get & set this value because it sure isn't stored in the LDAP directory any longer (or wasn't even in the first place?).

Script language: PHP
OSX Server: 10.8

(Note: I come from a Unix and some what Windows background and finding things in OSX is more confusing than not since 80% of the guides and documentation is obsolete if you even manage to find any on the interwebs, hence why i need help with even the basic stuff as figuring out how and where the mechanics are for different password/account parts)


I am not sure if this is what you are looking for. However in the apple server tool you can set the total login attempts to any number you'd like.

Just go to the Open Directory menu at the left. Then click on your server at the right, and then click on the cog and choose change password policy. Here you can choose to disable logging in after X attempts.

Now to reset the option you can this in command line:

pwpolicy -a <diradmin> -p <password> -u <username to unlock> -setpolicy "isDisabled=0"

this way this specific user will be unlocked

You can run a bash script looking into the LDAP and see which users are locked to unlock these users. To do so, you must also look when a user is locked. However, to be honest with you I don't know if this is possible.

So another option would be to run a cronjob to unlock all users every half an hour. Though some users will be unlocked after 1 minute if you do this.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.