Check Zimbra Account Status: 3 Easy Ways, No Mistakes

To check Zimbra account status you have three practical options on the command line: zmprov ga for one account, zmaccts for a full report, and an LDAP query for a list filtered by status. This guide keeps the two methods from the original article, the LDAP bash script and the zmaccts one-liner, and adds the meaning of every status as defined in the Zimbra Administrator Guide so you know what the result tells you. Run every command on the mailbox server as the zimbra user (su - zimbra).

Related guides on this blog: lock and unlock a Zimbra account, list accounts that have not logged in for x days and Zimbra custom SpamAssassin rules.

Contents

• Zimbra account statuses and what they mean
• Method 1: check Zimbra account status of one account with zmprov
• Method 2: check Zimbra account status with zmaccts
• Method 3: bash script that queries LDAP to check Zimbra account status
• How the script works
• Security note
• Check Zimbra account status in the Admin Console
• What to do after you check Zimbra account status
• References

Zimbra account statuses and what they mean

Before you check Zimbra account status for a whole domain, know which values can appear. The attribute is zimbraAccountStatus, and the Administrator Guide describes these states:

• active: normal account, login and mail delivery work.
• locked: the user cannot log in, but mail continues to be delivered. Used when an account may be compromised.
• maintenance: login is disabled and incoming mail is queued at the MTA. Zimbra sets it during backup, import, export and restore.
• pending: assigned when an account is created but not ready yet; login is disabled and messages are bounced.
• closed: login is disabled and messages are bounced; used to soft-delete an account before it is removed.
• lockout: set automatically after too many wrong passwords, cannot be assigned by an administrator and can be removed at any time.

So when you check Zimbra account status for a user who "cannot log in", the answer already tells you the cause: locked and lockout are access problems, closed and pending also bounce new mail.

The three ways to check Zimbra account status, run as the zimbra user.

Method 1: check Zimbra account status of one account with zmprov

The fastest way to check Zimbra account status for a single mailbox is to read the attribute with zmprov ga (getAccount) and filter it with grep:

zmprov ga user@mail.huuphan.com | grep zimbraAccountStatus

The command prints one line in the form zimbraAccountStatus: active. The same command works for the other attributes; zimbraLastLogonTimestamp shows the last login if you want to find inactive mailboxes. Note that the Administrator Guide says the last logon timestamp is returned only if you do not use the -l flag, because -l limits the query to LDAP.

Method 2: check Zimbra account status with zmaccts

The second method from the original post uses zmaccts. The Administrator Guide describes it as a report that lists all accounts, their status, when they were created and the last time anyone logged on, with a domain summary of the number of accounts per status. To list only the active accounts of one domain and print just the address column, filter the report:

zmaccts | grep active | grep @mail.huuphan.local | awk '{print $1}'

Replace active with locked, closed, pending or maintenance to list accounts in another state, and replace the domain with your own. Because grep active matches any line containing that word, check the first lines of the real report on your server once before you rely on the result in a script.

Method 3: bash script that queries LDAP to check Zimbra account status

The original script asks the Zimbra LDAP server for every account of a domain and prints the address followed by its status. It reads the LDAP host, bind DN and password from zmlocalconfig, builds an ldapsearch command and reformats the distinguished names into mail addresses with sed. Save it as zstatus.sh and pass the domain as the first argument:

#!/bin/bash
# sed ':a;N;$!ba;s/\n/ /g' file : command line
# :a create a label 'a'
# N append the next line to the pattern space
# $! if not the last line, ba branch (go to) label 'a'
# s substitute, /\n/ regex for new line, / / by a space, /g global match
# sed loops until the last line and replaces every \n with a space
LDAP_HOST=`/opt/zimbra/bin/zmlocalconfig ldap_host | cut -d\ '' -f3`
LDAP_PASSWORD=`/opt/zimbra/bin/zmlocalconfig -s zimbra_ldap_password | cut -d\ '' -f3`
LDAP_USERDN=`/opt/zimbra/bin/zmlocalconfig zimbra_ldap_userdn | cut -d\ '' -f3`
LDAPSEARCH="/opt/zimbra/bin/ldapsearch -D "$LDAP_USERDN" -w$LDAP_PASSWORD -H ldap://$LDAP_HOST -LLL -o ldif-wrap=no"
ZIMBRA_ACCOUNT_STATUS="zimbraAccountStatus"
DOMAIN=$1
$LDAPSEARCH "(&(objectClass=zimbraAccount)($ZIMBRA_ACCOUNT_STATUS=*)(mail=*$DOMAIN))" $ZIMBRA_ACCOUNT_STATUS | sed 's/ou=people,//g' | sed 's/dn: uid=/:/g' | sed 's/,dc=/@/' | sed 's/,dc=/./g' | sed 's/,dc=/./g' | sed ':a;N;$!ba;s/\n/ /g' | sed "s/$ZIMBRA_ACCOUNT_STATUS: //g" | sed 's/:/\n/g'

The last sed expression was cut off in the old article (the closing quote was missing); it is complete above. Run it with bash zstatus.sh huuphan.com as the zimbra user. Each output line is one mailbox with its status.

How the script works

1. The three zmlocalconfig calls read the LDAP host, the bind user and its password from the local configuration of the server.
2. ldapsearch runs the filter objectClass=zimbraAccount with a zimbraAccountStatus value and a mail address that ends with your domain.
3. The chain of sed commands turns dn: uid=user,ou=people,dc=huuphan,dc=com into user@huuphan.com and puts the status after it.

To check Zimbra account status for one state only, change the filter, for example by replacing $ZIMBRA_ACCOUNT_STATUS=* with zimbraAccountStatus=locked. That is standard LDAP filter syntax.

Security note

The script passes the LDAP password on the command line with -w, so any local user can see it in the process list while the script runs. Run it only on the mail server as the zimbra user, never on a shared host, and keep the file mode private (chmod 700 zstatus.sh). The OpenLDAP -y option, which reads the password from a file, avoids the problem if your ldapsearch accepts it.

Check Zimbra account status in the Admin Console

The Administrator Guide also describes a graphical way: in the Admin Console, advanced search lets you look for accounts by status (Active, Closed, Locked, Logout, Pending or Maintenance) and by last login time. It is useful for a quick look; the command line methods above are better when you need a list in a file or a scheduled report.

What to do after you check Zimbra account status

• locked and you want the user back: zmprov ma user@domain zimbraAccountStatus active, see the lock and unlock guide.
• maintenance without a running backup or restore: set it back to active, because mail is only being queued.
• closed accounts that nobody needs: delete them after a backup, which also frees the license count.
• pending: finish the account setup or delete it.

References

• Zimbra Collaboration Administrator Guide (account statuses, zmaccts, zmprov)
• Zimbra wiki: zmprov

In short: use zmprov ga for one mailbox, zmaccts for the full report and the LDAP script for custom filters whenever you need to check Zimbra account status.