User list fails on protected AD account krbtgt_AzureAD

[DavidePrincipi]

When NS8 tries to list users from a remote Active Directory, it crashes if one of the accounts has missing information for fields like "account locked." This happens with special hidden accounts that Windows protects, such as the krbtgt_AzureAD account used for Azure AD Kerberos. NS8 expects those fields to always have a value, so when one is missing it stops with an error instead of simply skipping it.

To Reproduce

1. Connect NS8 to a remote AD domain that has Azure AD Kerberos / Azure AD Connect set up (this creates a protected account named something like krbtgt_AzureAD).
2. Run: api-cli run list-domain-users --data '{"domain":"<your-domain>"}'
3. The command fails with an error like:

   TypeError: unsupported operand type(s) for &: 'list' and 'int'
   

Expected behavior
The user list should load normally. If some information can't be read for a particular account (because Windows restricts access to it), NS8 should just treat it as "unknown" and continue, instead of crashing the whole list.

Components
NS8 core 3.21.1

Additional context

• The account that triggers this is a special system account, not a normal user — Windows hides some of its details from regular accounts for security reasons.
• Full error and LDAP data available on request.

See also

• Discussion https://mattermost.nethesis.it/nethesis/pl/xj7gran5atfnipu9guuib5yzeh

---

Thanks to @lucagasparini