是啊 - 的ValidateCredentials API给太多的误报

Yup - the ValidateCredentials API gives too many false positives.

这是是黑色艺术，但你可以检查的用户帐户控制属性并的 MS-DS-用户帐户控制计算的属性双方已密码过期位。

This is something of a black art but you can check User-Account-Control attribute and ms-DS-User-Account-Control-Computed attribute both of which have "Password Expired" bits.

我通常使用上述但有些人建议直接使用Windows API - 参见Active目录（LDAP） - 检查帐户锁定/密码过期

I normally use the above but some people suggest using the Windows API directly - refer Active Directory (LDAP) - Check account locked out / Password expired.