The following vbscript code should be a good starting point. Make sure you
change the XXX, YYY, ZZZ to your specific base DN.
'------------------------------------------------------------------
Set objConnection = CreateObject("ADODB.Connection")
objConnection.Open "Provider=ADsDSOObject;"
Set objCommand = CreateObject("ADODB.Command")
objCommand.ActiveConnection = objConnection
cmdText =
"<LDAP://DC=XXX,DC=YYY,DC=ZZZ>;(objectCategory=person);sAMAccountName,userAc
countControl;subtree"
objCommand.CommandText = cmdText
Set rs = objCommand.Execute
While not rs.EOF
Wscript.echo rs("sAMAccountName"), Hex(rs("userAccountControl"))
rs.MoveNext
Wend
'-------------------------------------------------------------------
NOTE that disabled users will show up as having "2" as the last Hex digit in
userAccountControl