Hi Kenneth,

You can query the "directory_objects" table of the LFDS database. The column you're interested in is called "login_fail_count", as well as possibly "last_login_fail_time".

LFDS dynamically evaluates user account Locked status using those values through an internal function that's called on relevant actions, such as retrieving account details in the web admin UI (or via SDK) or the user attempting to log in. There is no specific "Locked" value in the LFDS database to query directly.

Here is pseudocode for queries to return Locked user accounts:

SELECT 'name'
FROM 'directory_objects'
WHERE 'login_fail_count' >= $permanentLockoutFailedAttemptThreshold
# and/or
WHERE 'login_fail_count' >= $temporaryLockoutFailedAttemptThreshold AND 'last_login_fail_time' <= ($currentTime - $temporaryLockoutDuration)

A different database table (not sure offhand) has the temporary and permanent lockout configuration settings if you want to get the fail attempt thresholds and temp lockout duration dynamically. Poke around for anything that sounds like it deals with password settings.