title: Query AD for active users
body: <p>I want to create a script to identify AD users which are valid in an active directory via ldap. The problem is I don't know what means valid users in an active directory exactly...</p>
  
  <p>Imagine we have a list of windows logins. We want to query if a user is able to login. That means the account is not expired, is not inactive, ... what else?</p>
  
  <pre><code>res = l.search_s("DC=...",
                   ldap.SCOPE_SUBTREE,
                   '(&amp;(objectClass=user)(sAMAccountName=%s))' % sAMAccountName,
                   ['lastlogon','accountExpires', 'cn', 'mail', 'lockoutTime'])
  </code></pre>
  
  <p>My script becomes more and more complex with if-else-if-else. I look for a clear and transparent way to query: Is a user currently able to login?</p>