I noticed that with Active Roles 7.4.3.and 7.4.1 that the New-QADComputer commandlet is ignoring userAccountControl values. It will only set 4128 PASSWD_NOTREQD
We have a ARS policy that will enforce 4096, and the MMC and WebUI appear to set it, but in fact set 4128. Trying to create an account via powershell will net this
New-QADComputer : Corporate policy violation. The 'userAccountControl' property value does not conform to corporate policy.
The specified value '4128' does not conform to policy requirements.
At line:2 char:1
+ New-QADComputer -ParentContainer ...
Here's the powershell I'm running
New-QADComputer -Name 'anewComputer' `
-SamAccountName 'anewComputer$' `
-ParentContainer "domain/ou/ou/..." `
-IncludedProperties userAccountControl,
edsaJoinComputerToDomain `
-ObjectAttributes @{userAccountControl=4096;
'edsaJoinComputerToDomain'='domain\auser'
} `
-proxy `
-service arsadminservice