Active Directory UDF

[water]

Hi supersonic,

at the moment I'm searching the internet to see what's possible and where the limitations are.

I will post my findings so you can see if such a global search function fits your needs.

I first got the idea to extend the UDF when I found this "Document Forest" script.

The changes in the UDF shouldn't be script breaking. Additional parameters should let your scripts run without modification.

More information is needed - I will be back as soon as I know how to do it.

Testers are welcome because I only have a single domain AD available.

Have a nice weekend

water

[water]

Hi supersonic,

If you like you could run the following script. The last column in the array is set to True if the domain controller is a global catalogue.

Could you please check if the results are correct?

To cross-check you could run the vbs in the last post of this thread.

expandcollapse popup

#include <ad.au3>
_AD_Open()
$aDC = _AD_ListDomainControllersEX()
_ArrayDisplay($aDC)
_AD_Close()

; #FUNCTION# ====================================================================================================================
; Name...........: _AD_ListDomainControllers
; Description ...: Enumerates all Domain Controllers, their distinguished name, their DNS host name, and the name of the site they reside in.
; Syntax.........: _AD_ListDomainControllers([$fAD_ListRO = FALSE])
; Parameters ....: $fAD_ListRO - Optional: If set to TRUE only returns RODC (read only domain controllers). Default = FALSE
; Return values .: Success - One-based two dimensional array with the following information:
;                  |0 - Domain Controller: Name
;                  |1 - Domain Controller: Distinguished Name (FQDN)
;                  |2 - Domain Controller: DNS host name
;                  |3 - Site: Name
;                  |4 - Site: Distinguished Name (FQDN)
;                  |5 - Site: List of subnets that can connect to the site using this DC in the format x.x.x.x/mask - multiple subnets are separated by comma
;                  |6 - Global Catalog: Set to True if the DC is a Global Catalog
;                  Failure - "", sets @error to:
;                  |1 - No Domain Controllers found
; Author ........: water (based on VB functions by Richard L. Mueller)
; Modified.......:
; Remarks .......: This function only lists writeable DCs (default). To list RODC (read only DCs) use parameter $fAD_ListRO
; Related .......:
; Link ..........: http://www.rlmueller.net/Enumerate%20DCs.htm
; Example .......: Yes
; ===============================================================================================================================
Func _AD_ListDomainControllersEX($fAD_ListRO = False)

    Local $oAD_DC, $oAD_Site, $oAD_Result
    Local Const $NTDSDSA_OPT_IS_GC = 1
    $oAD_Command.CommandText = ";(objectClass=nTDSDSARO);ADsPath;subtree"
    Local $oAD_RecordSet = $oAD_Command.Execute
    If Not IsObj($oAD_RecordSet) Or $oAD_RecordSet.RecordCount = 0 Then Return SetError(1, 0, "")
    ; The parent object of each object with objectClass=nTDSDSA is a Domain
    ; Controller. The parent of each Domain Controller is a "Servers"
    ; container, and the parent of this container is the "Site" container.
    $oAD_RecordSet.MoveFirst
    Local $aAD_Result[1][7], $iCount1 = 1, $aAD_SubNet, $aAD_Temp, $sAD_Temp
    Do
        ReDim $aAD_Result[$iCount1 + 1][7]
        $oAD_Result = _AD_ObjGet($oAD_RecordSet.Fields("AdsPath" ).Value)
        $oAD_DC = _AD_ObjGet($oAD_Result.Parent)
        $aAD_Result[$iCount1][0] = $oAD_DC.Get("Name")
        $aAD_Result[$iCount1][1] = $oAD_DC.serverReference
        $aAD_Result[$iCount1][2] = $oAD_DC.DNSHostName
        $oAD_Result = _AD_ObjGet($oAD_DC.Parent)
        $oAD_Site = _AD_ObjGet($oAD_Result.Parent)
        $aAD_Result[$iCount1][3] = StringMid($oAD_Site.Name, 4)
        $aAD_Result[$iCount1][4] = $oAD_Site.distinguishedName
        $aAD_SubNet = $oAD_Site.GetEx("siteObjectBL")
        For $iCount2 = 0 To UBound($aAD_SubNet) - 1
            $aAD_Temp = StringSplit($aAD_SubNet[$iCount2], ",")
            $sAD_Temp = StringMid($aAD_Temp[1], 4)
            If $iCount2 = 0 Then
                $aAD_Result[$iCount1][5] = $sAD_Temp
            Else
                $aAD_Result[$iCount1][5] = $aAD_Result[$iCount1][5] & "," & $sAD_Temp
            EndIf
        Next
        ; Is the DC a GC? Taken from: http://www.activexperts.com/activmonitor/windowsmanagement/adminscripts/computermanagement/ad/
        Local $oAD_DCRootDSE = _AD_ObjGet("LDAP://" & $oAD_DC.DNSHostName & "/rootDSE")
        Local $sAD_DsServiceDN = $oAD_DCRootDSE.Get("dsServiceName")
        Local $oAD_DsRoot  = _AD_ObjGet("LDAP://" & $oAD_DC.DNSHostName & "/" & $sAD_DsServiceDN)
        Local $iAD_DCOptions = $oAD_DsRoot.Get("options")
        If BitAND($iAD_DCOptions, $NTDSDSA_OPT_IS_GC) = 1 Then
            $aAD_Result[$iCount1][6] = True
        Else
            $aAD_Result[$iCount1][6] = False
        EndIf
        $oAD_RecordSet.MoveNext
        $iCount1 += 1
    Until $oAD_RecordSet.EOF
    $oAD_RecordSet.Close
    $aAD_Result[0][0] = UBound($aAD_Result, 1) - 1
    $aAD_Result[0][1] = UBound($aAD_Result, 2)
    Return $aAD_Result

EndFunc   ;==>_AD_ListDomainControllers

Edited June 5, 2011 by water

[water]

Hi supersonic,

as not all attributes are replicated to the Global Catalog I wrote the following function to retrieve the names of all replicated attributes. In my environment 300 attributes are replicated.

expandcollapse popup

#include <ad.au3>
_AD_Open()
$aAttributes = _AD_GetGCAttributes()
_ArrayDisplay($aAttributes)
_AD_Close()

; #FUNCTION# ====================================================================================================================
; Name...........: _AD_GetGCAttributes
; Description ...: Enumerates all attributes that are replicated to the Global Catalog.
; Syntax.........: _AD_GetGCAttributes()
; Parameters ....: None
; Return values .: Success - One-based one dimensional array with names of all attributes that are replicated to the Global Catalog
;               Failure - "", sets @error to:
;               |1 - The LDAP query returned no records or another error occurred
; Author ........: water
; Modified.......:
; Remarks .......:
; Related .......:
; Link ..........:
; Example .......: Yes
; ===============================================================================================================================
Func _AD_GetGCAttributes()

    Local $sAD_SchemaNamingContext = $oAD_RootDSE.Get("SchemaNamingContext")
    $oAD_Command.CommandText = "<LDAP://" & $sAD_HostServer & "/" & $sAD_SchemaNamingContext & ">;(&(objectClass=attributeSchema)(isMemberOfPartialAttributeSet=TRUE));lDAPDisplayName;subtree"
    Local $oAD_RecordSet = $oAD_Command.Execute
    If @error <> 0 Or Not IsObj($oAD_RecordSet) Then Return SetError(1, @error, "")
    Local $aAD_Attributes[$oAD_RecordSet.Recordcount+1] = [$oAD_RecordSet.Recordcount]
    Local $iAD_Index = 1
    $oAD_RecordSet.MoveFirst
    While Not $oAD_RecordSet.EOF
        $aAD_Attributes[$iAD_Index] = $oAD_RecordSet.Fields("lDAPDisplayName").Value
        $iAD_Index = $iAD_Index + 1
        $oAD_RecordSet.MoveNext
    WEnd
    Return $aAD_Attributes

EndFunc   ;==>_AD_GetObjectAttribute

Edited June 4, 2011 by water

[supersonic]

Hi water,

here are the results...

The UDF '_AD_GetGCAttributes()' works fine - in our environment 357 attributes are replicated.

If calling '_AD_ListDomainControllersEX()' this error message returns:

Line 6381 (File "C:\Users\Administrator\Desktop\_AD_ListDomainControllersEX.exe"): Error: Error parsing function call.

'_AD_ListDomainControllers()' works fine and returns all DCs.

Running the VBS I get the following error message:

Skript: C:\User\Administrator\Desktop\listdcs.vbs

Zeile: 60

Zeichen: 1

Fehler: Die Verzeichniseigenschaft wurde nicht im Cache gefunden.

Code: 8000500D

Quelle: Active Directory

Greets,

-supersonic.

[water]

Hi supersonic,

"Error parsing function call." seems to be an AutoIt syntax error. Could you please run Au3Check in SciTE pressing "CTRL+F5" and post the code in error?

BTW: The line number seems a bit high. Do you just run the test script I posted?

Edited June 5, 2011 by water

[supersonic]

Hi water,

please, can you provide me a compile script for '_AD_ListDomainControllersEX()'?

Greets,

-supersonic.

[water]

Hi supersonic,

just use the example I posted I just had to change the #include line because the forum editor seems to drop everything between < and >.

[supersonic]

Hi water,

ohhh... it was my fault...

Now the script itself runs fine...

'_AD_ListDomainControllersEX()' returns @error = 1.

Greets,

-supersonic.

Edited June 5, 2011 by supersonic

[water]

Hi supersonic,

that's fine but @error = 1 means "No Domain Controllers found". That's caused by a typo in the _AD_ListDomainControllersEX function and causing it to just query Read-Only Domain Controllers.

Could you please replace line

$oAD_Command.CommandText = ";(objectClass=nTDSDSARO);ADsPath;subtree"

with

$oAD_Command.CommandText = ";(objectClass=nTDSDSA);ADsPath;subtree"

Edited June 5, 2011 by water

[supersonic]

I'll test it tomorrow morning. I hope you can wait until then...

[supersonic]

Hi water,

still no luck (@error = 1) after changing the requested script line...

Greets,

-supersonic.

[water]

Hi supersonic,

very, very strange.

OK, here is the most current version of the example script.

If this still returns @error = 1 then could you please run the examples cript for _AD_ListDomainControllers?

expandcollapse popup

#include <ad.au3>
_AD_Open()
$aDC = _AD_ListDomainControllersEX()
MsgBox(0,"", "_AD_ListDomainControllersEX Returncode: " & @error)
_ArrayDisplay($aDC)
_AD_Close()

Func _AD_ListDomainControllersEX($fAD_ListRO = False)

    Local $oAD_DC, $oAD_Site, $oAD_Result
    Local Const $NTDSDSA_OPT_IS_GC = 1
    $oAD_Command.CommandText = "<LDAP://" & $sAD_Configuration & ">;(objectClass=nTDSDSA);ADsPath;subtree"
    If $fAD_ListRO Then $oAD_Command.CommandText = "<LDAP://" & $sAD_Configuration & ">;(objectClass=nTDSDSARO);ADsPath;subtree"
    Local $oAD_RecordSet = $oAD_Command.Execute
    If Not IsObj($oAD_RecordSet) Or $oAD_RecordSet.RecordCount = 0 Then Return SetError(1, 0, "")
    ; The parent object of each object with objectClass=nTDSDSA is a Domain
    ; Controller. The parent of each Domain Controller is a "Servers"
    ; container, and the parent of this container is the "Site" container.
    $oAD_RecordSet.MoveFirst
    Local $aAD_Result[1][7], $iCount1 = 1, $aAD_SubNet, $aAD_Temp, $sAD_Temp
    Do
        ReDim $aAD_Result[$iCount1 + 1][7]
        $oAD_Result = _AD_ObjGet($oAD_RecordSet.Fields("AdsPath" ).Value)
        $oAD_DC = _AD_ObjGet($oAD_Result.Parent)
        $aAD_Result[$iCount1][0] = $oAD_DC.Get("Name")
        $aAD_Result[$iCount1][1] = $oAD_DC.serverReference
        $aAD_Result[$iCount1][2] = $oAD_DC.DNSHostName
        $oAD_Result = _AD_ObjGet($oAD_DC.Parent)
        $oAD_Site = _AD_ObjGet($oAD_Result.Parent)
        $aAD_Result[$iCount1][3] = StringMid($oAD_Site.Name, 4)
        $aAD_Result[$iCount1][4] = $oAD_Site.distinguishedName
        $aAD_SubNet = $oAD_Site.GetEx("siteObjectBL")
        For $iCount2 = 0 To UBound($aAD_SubNet) - 1
            $aAD_Temp = StringSplit($aAD_SubNet[$iCount2], ",")
            $sAD_Temp = StringMid($aAD_Temp[1], 4)
            If $iCount2 = 0 Then
                $aAD_Result[$iCount1][5] = $sAD_Temp
            Else
                $aAD_Result[$iCount1][5] = $aAD_Result[$iCount1][5] & "," & $sAD_Temp
            EndIf
        Next
        ; Is the DC a GC? Taken from: http://www.activexperts.com/activmonitor/windowsmanagement/adminscripts/computermanagement/ad/
        Local $oAD_DCRootDSE = _AD_ObjGet("LDAP://" & $oAD_DC.DNSHostName & "/rootDSE")
        Local $sAD_DsServiceDN = $oAD_DCRootDSE.Get("dsServiceName")
        Local $oAD_DsRoot  = _AD_ObjGet("LDAP://" & $oAD_DC.DNSHostName & "/" & $sAD_DsServiceDN)
        Local $iAD_DCOptions = $oAD_DsRoot.Get("options")
        If BitAND($iAD_DCOptions, $NTDSDSA_OPT_IS_GC) = 1 Then
            $aAD_Result[$iCount1][6] = True
        Else
            $aAD_Result[$iCount1][6] = False
        EndIf
        $oAD_RecordSet.MoveNext
        $iCount1 += 1
    Until $oAD_RecordSet.EOF
    $oAD_RecordSet.Close
    $aAD_Result[0][0] = UBound($aAD_Result, 1) - 1
    $aAD_Result[0][1] = UBound($aAD_Result, 2)
    Return $aAD_Result

EndFunc   ;==>_AD_ListDomainControllers

[water]

Hi supersonic,

at the moment I'm collecting ideas how to implement the global catalog search function. That's what I have so far:

• The domain search function is named _AD_GetObjectsInOU. I don't like the name but to be consistent I could name the GC search function _AD_GetObjectsInGC
• I'm going to use the connection opened with _AD_Open (including credentials if specified) and connect to the default or given domain controller. If this domain controller is no GC an error will be returned
• You can pass a GC you wish to connect to as parameter to the GC search function

Some issues I want to discuss:

• Do you think additional functions need to access the global catalog? Like _AD_GetObjectAttribute or _AD_GetPasswordExpired?
• Do you want to connect to the domain and the Global Catalog at the same time? Or can we add a parameter to _AD_Open that specifies the access type? This has the advantage that all AD functions (at least the query functions should work witht he GC)
• Do you think different credentials (opposed to those used in _AD_Open) might be needed to access the GC catalog?

The needs of you and other users have a big effect on the design. Edited June 6, 2011 by water

[supersonic]

Hi water,

the current/last version of '_AD_ListDomainControllersEX()' works like expected. Thank you for that!

- To name the seach function '_AD_GetObjectsInGC()' sounds okay for me. '_AD_GetObjectsInOU()' doesn't sound bad either.

- If a domain controller has no GC you can't query it? Currently with V0.43 this works.

If a domain controller has no GC and you query it then the "Non-GC-DC" passes the query to another DC with a GC.

May be I got you wrong? Please, can you explain a bit more?

- What do you mean with "You can pass a GC..."?

There is only one GC in each (sub-)domain; each domain controller can (not must) store the GC.

Do you mean GC = DC?

- I think it could be too complicated to access the GC with different creds.

You should access the GC with the same creds for calling '_AD_Open()'.

Thank you so far,

-supersonic.

Edited June 6, 2011 by supersonic

[water]

Hi supersonic,

In a forest there can be multiple GCs. A GC is a DC that has an additional database to hold the information about the forest. On every DC there is at least the database for the domain. In addition the machine can have a second database as GC.

You can access a GC in two ways:

Replace LDAP:// with GC:// or access the machine where the DC is located on a different port with LDAP:// (that's what I'm going to do because the UDF has to be changed only in _AD_Open).

If I try to access a machine that isn't a GC then I will get an error because no one listens on the port specified (at least I think so).

What do you mean with "You can pass a GC..."?

Now you can pass the hostname of the DC you want to connect to to _AD_Open (4th parameter). This will be true for the GC as well. If you don't specify a GC _AD_Open will select one for you.

At the moment I think i will extend the UDF as follows:

• _AD_Open gets an additional parameter to indicate that you want connect to a GC. This means that all function calls now access the GC (I'm not sure if this works well but this needs to be tested)
• No _AD_GetObjectsInGC will be necessary. When connected to a GC _AD_GetObjectsInOU should work just fine
• This means you can't work with a DC and a GC at the same time. You have to do _AD_Open, _AD_Close to switch between GC and DC

Does this make sense?

[supersonic]

Hi water,

summarized (just to make sure we're talking about the same issue):

- A DC could store a copy of the GC.

- If you query a DC without a GC, the query will be passed to another DC keeping a copy of the GC.

- The GC represents the forest the DC belongs to.

Am I right?

Your suggestion of how to extend the UDF makes sense to me.

Greets,

-supersonic.

Edited June 6, 2011 by supersonic

[Bert]

I just downloaded and tried a few things. NICE WORK!

[water]

Glad you like it

I "beautified" the existing UDF written by John Clelland and added some functions requested by users (and me). Therefore it's a mixture of different programming styles and not as clean as if I had written it from scratch.

But users seem to be happy with it.

[water]

Hi water,

summarized (just to make sure we're talking about the same issue):

- A DC could store a copy of the GC. Correct

- If you query a DC without a GC, the query will be passed to another DC keeping a copy of the GC. If I query dc.microsoft.com:3268 (the GC should listen at this port) and there is no GC on this machine I will get an error

- The GC represents the forest the DC belongs to. Correct

Am I right?

Your suggestion of how to extend the UDF makes sense to me.

Greets,

-supersonic.

Hi supersonic,

find my comments above. That's how I understand GC at the moment.

How many query functions work when run against a GC will have to be tested.

I will create some test scripts and post them.

Edited June 6, 2011 by water

[water]

Version 1.0.0 has been released.

Please test before using in production!

For download please see my signature.