Apologies if this isn't the right place for it - but I think it's the right place to ask questions about how things work (wiki didn't seem appropriate).
I'm using the AD UDF (stable) for a VPN login/drive mapping GUI/script that runs on both domain PCs as well as home PCs (love it btw, does an AWESOME job) - and we had a strange error which I've just finally managed to track down, and I wanted to bring it to your attention. The problem we were having is some of our home users would immediately get locked accounts when they tried to run our script. It was consistent for each user, they either had the issue or did not. It ended up being that their home PC username exactly matched their work username (e.g. at home they're jsmith, at work they're jsmith).
In breaking down and digging into it, I found that even if you specify the first 5 parameters (user, pass, domain, host, config), _AD_Open still attempts to 'test' certain things without the user parameter. This was compounded (for us) by the fact that we use some role accounts to do things like check password age, expiration, and whether a username is valid. and always close the connection and open a new one each time. In short, _AD_Open was being called 3 times (and doing LDAP binds without the specified credentials, using ObjGet() ), and this locked their account before the script was finished.
I've fixed it for our scenario, by simply commenting out the chunk where the RootDSE's are attempted, and explicitly re-setting the $sAD_DNSDomain / $sAD_HostServer / $sAD_Configuration to their parameter values afterwards, but I wanted to pass it on back both as feedback and a heads up to anyone running into a similar problem. Also, I hate butchering even my own local copy of such a useful UDF, and wouldn't want to be removing anything important for other functions I might use down the road.
If a non-domain machine uses this library, and the account name of the local user running it exactly match an account name on your domain, they will cause a failed login attempt every time _AD_Open is called. I don't know what the behavior would be if you had a domain machine in another domain w/ a similar account name match, as I haven't dug through the nested IF statements, but that might be worth poking at as well.
I'm of course available for any more information, details, etc.
Cheers,
-Martin