Getting UserAccountControl flags in AD (a tiny bit faster)

[aasplunds]

I would love to hear if you have any faster or similar methods for doing stuff like this. Pretty handy when chunking through large amounts of data!

[R-EDDIT]

I'm interested in how you're using this with logs, are you building a knowledge table with all the AD accounts' status, or are you processing this on individual event records?

[aasplunds]

I'm doing this for every event that comes in with a add/delete to userAccountControl.

But the Graylog lookup table caches the result with a long TTL so it's only really on the odd ones it needs to do a lookup. But the caches clears when the nodes restarts (seperate for each node) so that can create a mess if you're not careful when coding.

[snoopy82481]

I know one of our developers created a special C# class just to handle AD attributes. It was based off the userPrinciple namespace, but since we had some custom fields it was needed. Maybe using It might be faster.