How do I programatically dissable a user account?

Question

I'm writing an application that needs to be 21 CFR Part 11 compliant, and this would be an effective loss management procedure for lost/stolen usernames and passwords.  I'm using the DSC 8.2.1 module and can see no way to do this other than through the Domain Account Manager by the administrator.  I would like my application program to be able to dissable an account after a number of failed login attempts.  Since this used to be a feature of earlier versions of the DSC module, I don't understand why NI took it out of later versions.
Thanks,
Craig

Answer 1

Hi, Austin,
Thanks for the reply.  Yes, I have read through the Developer Zone tutorial many times, and have been using it as a reference.  I posted a question a couple of months ago that you replied to about how to set minutes idle until logoff and number of failed login attempts.  I was able to implement an automatic logout feature after a number of minutes of inactivity in the application just fine.  However, in the very last part of the article, it says this:
(c) Following loss management procedures to electronically deauthorize lost, stolen, missing, or otherwise potentially compromised tokens, cards or password information, and to issue temporary or permanent replacements using suitable, rigorous controls.
Although it is ultimately the responsibility of the developer to implement procedures to ensure that this regulation is met, the DSC module provides you with some tools to help. The locking out of user names that fail consecutive logins can help to identify a compromised user name. Also, the administrator can deactivate any user name and can add a new temporary user name and password if necessary.
(d) Use of transaction safeguards to prevent unauthorized use of passwords and/or identification codes, and to detect and report in an immediate and urgent manner any attempts at their unauthorized use to the system security unit, and, as appropriate, to organizational management.
The user lockout feature after a specified number of consecutive failed logins is a safeguard against unauthorized access to the system. In addition to this feature, you can log any failed login in a system file that the administrator can monitor to be notified of the failed events. 
You can see from the underlined statements that this used to be a feature in the DSC module, but it appears to me that there is no longer any way to disable a user account except through the Domain Account Manager.  Perhaps that is enough to satisfy part (c) of the above regulation now, but it seems like a useful feature to have so that an unauthorized person cannot sit there all day long trying passwords for a specific account.  I have looked through all of the property node and invoke node classes and methods, but could find nothing pertaining to security or user accounts.  A search of the help pages also turns up nothing.  Did I miss something?
In the other passage I underlined, there is a reference to logging failed login attempts to a system file, but again I have not been able to find any kind of reference to how to do this.  Do you have any idea?  The standard read/write files will not work because system log files are generally protected, hidden, or encrypted.  Besides, if the program attempts to write to a system file with user permissions and not administrator permissions it won't work.  If it did work, then the user could just go and alter those system files to erase any record of their doings.  So really, logging failed login attempts in a system file is not a trivial task as the underlined statement above suggests.  Any suggestions would be appreciated...
Thanks,
Craig