Problem:
The expectation is that once an expiry date is set for an account—as described in the doku
Account expiry date
Defines a date to automatically deactivate the user account. Use this setting for user accounts that are active for a defined time period, for example interns.
If you delete the date or update it to a future date, the user account remains available for sign-in.
— the account should be automatically locked. Unfortunately, this is not currently working due to three known bugs regarding this issue.
Solution:
As a workaround, you can either modify the existing script (/usr/share/univention-directory-manager-tools/lock_expired_accounts), copy and edit it to be run via a cronjob, or simply use this small script also via cron.
#!/bin/bash
todayZulu=$(date -u +"%Y%m%d000000Z")
udm users/user list --filter "(&(krb5ValidEnd<=$todayZulu)(krb5KDCFlags=126))" |grep DN:|cut -d ' ' -f2-|while read -r dn; do udm users/user modify --dn "$dn" --set disabled=1;done