Active Directory UDF

water · June 2, 2011

Hi supersonic,

at the moment I'm searching the internet to see what's possible and where the limitations are.

I will post my findings so you can see if such a global search function fits your needs.

I first got the idea to extend the UDF when I found this "Document Forest" script.

The changes in the UDF shouldn't be script breaking. Additional parameters should let your scripts run without modification.

More information is needed - I will be back as soon as I know how to do it.

Testers are welcome because I only have a single domain AD available.

Have a nice weekend

water

water · June 4, 2011

Hi supersonic,

If you like you could run the following script. The last column in the array is set to True if the domain controller is a global catalogue.

Could you please check if the results are correct?

To cross-check you could run the vbs in the last post of this thread.

#include <ad.au3>
_AD_Open()
$aDC = _AD_ListDomainControllersEX()
_ArrayDisplay($aDC)
_AD_Close()

; #FUNCTION# ====================================================================================================================
; Name...........: _AD_ListDomainControllers
; Description ...: Enumerates all Domain Controllers, their distinguished name, their DNS host name, and the name of the site they reside in.
; Syntax.........: _AD_ListDomainControllers([$fAD_ListRO = FALSE])
; Parameters ....: $fAD_ListRO - Optional: If set to TRUE only returns RODC (read only domain controllers). Default = FALSE
; Return values .: Success - One-based two dimensional array with the following information:
;                  |0 - Domain Controller: Name
;                  |1 - Domain Controller: Distinguished Name (FQDN)
;                  |2 - Domain Controller: DNS host name
;                  |3 - Site: Name
;                  |4 - Site: Distinguished Name (FQDN)
;                  |5 - Site: List of subnets that can connect to the site using this DC in the format x.x.x.x/mask - multiple subnets are separated by comma
;                  |6 - Global Catalog: Set to True if the DC is a Global Catalog
;                  Failure - "", sets @error to:
;                  |1 - No Domain Controllers found
; Author ........: water (based on VB functions by Richard L. Mueller)
; Modified.......:
; Remarks .......: This function only lists writeable DCs (default). To list RODC (read only DCs) use parameter $fAD_ListRO
; Related .......:
; Link ..........: http://www.rlmueller.net/Enumerate%20DCs.htm
; Example .......: Yes
; ===============================================================================================================================
Func _AD_ListDomainControllersEX($fAD_ListRO = False)

    Local $oAD_DC, $oAD_Site, $oAD_Result
    Local Const $NTDSDSA_OPT_IS_GC = 1
    $oAD_Command.CommandText = ";(objectClass=nTDSDSARO);ADsPath;subtree"
    Local $oAD_RecordSet = $oAD_Command.Execute
    If Not IsObj($oAD_RecordSet) Or $oAD_RecordSet.RecordCount = 0 Then Return SetError(1, 0, "")
    ; The parent object of each object with objectClass=nTDSDSA is a Domain
    ; Controller. The parent of each Domain Controller is a "Servers"
    ; container, and the parent of this container is the "Site" container.
    $oAD_RecordSet.MoveFirst
    Local $aAD_Result[1][7], $iCount1 = 1, $aAD_SubNet, $aAD_Temp, $sAD_Temp
    Do
        ReDim $aAD_Result[$iCount1 + 1][7]
        $oAD_Result = _AD_ObjGet($oAD_RecordSet.Fields("AdsPath" ).Value)
        $oAD_DC = _AD_ObjGet($oAD_Result.Parent)
        $aAD_Result[$iCount1][0] = $oAD_DC.Get("Name")
        $aAD_Result[$iCount1][1] = $oAD_DC.serverReference
        $aAD_Result[$iCount1][2] = $oAD_DC.DNSHostName
        $oAD_Result = _AD_ObjGet($oAD_DC.Parent)
        $oAD_Site = _AD_ObjGet($oAD_Result.Parent)
        $aAD_Result[$iCount1][3] = StringMid($oAD_Site.Name, 4)
        $aAD_Result[$iCount1][4] = $oAD_Site.distinguishedName
        $aAD_SubNet = $oAD_Site.GetEx("siteObjectBL")
        For $iCount2 = 0 To UBound($aAD_SubNet) - 1
            $aAD_Temp = StringSplit($aAD_SubNet[$iCount2], ",")
            $sAD_Temp = StringMid($aAD_Temp[1], 4)
            If $iCount2 = 0 Then
                $aAD_Result[$iCount1][5] = $sAD_Temp
            Else
                $aAD_Result[$iCount1][5] = $aAD_Result[$iCount1][5] & "," & $sAD_Temp
            EndIf
        Next
        ; Is the DC a GC? Taken from: http://www.activexperts.com/activmonitor/windowsmanagement/adminscripts/computermanagement/ad/
        Local $oAD_DCRootDSE = _AD_ObjGet("LDAP://" & $oAD_DC.DNSHostName & "/rootDSE")
        Local $sAD_DsServiceDN = $oAD_DCRootDSE.Get("dsServiceName")
        Local $oAD_DsRoot  = _AD_ObjGet("LDAP://" & $oAD_DC.DNSHostName & "/" & $sAD_DsServiceDN)
        Local $iAD_DCOptions = $oAD_DsRoot.Get("options")
        If BitAND($iAD_DCOptions, $NTDSDSA_OPT_IS_GC) = 1 Then
            $aAD_Result[$iCount1][6] = True
        Else
            $aAD_Result[$iCount1][6] = False
        EndIf
        $oAD_RecordSet.MoveNext
        $iCount1 += 1
    Until $oAD_RecordSet.EOF
    $oAD_RecordSet.Close
    $aAD_Result[0][0] = UBound($aAD_Result, 1) - 1
    $aAD_Result[0][1] = UBound($aAD_Result, 2)
    Return $aAD_Result

EndFunc   ;==>_AD_ListDomainControllers

Edited June 5, 2011 by water

water · June 4, 2011

Hi supersonic,

as not all attributes are replicated to the Global Catalog I wrote the following function to retrieve the names of all replicated attributes. In my environment 300 attributes are replicated.

#include <ad.au3>
_AD_Open()
$aAttributes = _AD_GetGCAttributes()
_ArrayDisplay($aAttributes)
_AD_Close()

; #FUNCTION# ====================================================================================================================
; Name...........: _AD_GetGCAttributes
; Description ...: Enumerates all attributes that are replicated to the Global Catalog.
; Syntax.........: _AD_GetGCAttributes()
; Parameters ....: None
; Return values .: Success - One-based one dimensional array with names of all attributes that are replicated to the Global Catalog
;               Failure - "", sets @error to:
;               |1 - The LDAP query returned no records or another error occurred
; Author ........: water
; Modified.......:
; Remarks .......:
; Related .......:
; Link ..........:
; Example .......: Yes
; ===============================================================================================================================
Func _AD_GetGCAttributes()

    Local $sAD_SchemaNamingContext = $oAD_RootDSE.Get("SchemaNamingContext")
    $oAD_Command.CommandText = "<LDAP://" & $sAD_HostServer & "/" & $sAD_SchemaNamingContext & ">;(&(objectClass=attributeSchema)(isMemberOfPartialAttributeSet=TRUE));lDAPDisplayName;subtree"
    Local $oAD_RecordSet = $oAD_Command.Execute
    If @error <> 0 Or Not IsObj($oAD_RecordSet) Then Return SetError(1, @error, "")
    Local $aAD_Attributes[$oAD_RecordSet.Recordcount+1] = [$oAD_RecordSet.Recordcount]
    Local $iAD_Index = 1
    $oAD_RecordSet.MoveFirst
    While Not $oAD_RecordSet.EOF
        $aAD_Attributes[$iAD_Index] = $oAD_RecordSet.Fields("lDAPDisplayName").Value
        $iAD_Index = $iAD_Index + 1
        $oAD_RecordSet.MoveNext
    WEnd
    Return $aAD_Attributes

EndFunc   ;==>_AD_GetObjectAttribute

Edited June 4, 2011 by water

supersonic · June 5, 2011

Hi water,

here are the results... :huh2:

The UDF '_AD_GetGCAttributes()' works fine - in our environment 357 attributes are replicated.

If calling '_AD_ListDomainControllersEX()' this error message returns:

Line 6381 (File "C:\Users\Administrator\Desktop\_AD_ListDomainControllersEX.exe"): Error: Error parsing function call.

'_AD_ListDomainControllers()' works fine and returns all DCs.

Running the VBS I get the following error message:

Skript: C:\User\Administrator\Desktop\listdcs.vbs

Zeile: 60

Zeichen: 1

Fehler: Die Verzeichniseigenschaft wurde nicht im Cache gefunden.

Code: 8000500D

Quelle: Active Directory

Greets,

-supersonic.

water · June 5, 2011

Hi supersonic,

"Error parsing function call." seems to be an AutoIt syntax error. Could you please run Au3Check in SciTE pressing "CTRL+F5" and post the code in error?

BTW: The line number seems a bit high. Do you just run the test script I posted?

Edited June 5, 2011 by water

supersonic · June 5, 2011

Hi water,

please, can you provide me a compile script for '_AD_ListDomainControllersEX()'?

Greets,

-supersonic.

water · June 5, 2011

Hi supersonic,

just use the example I posted I just had to change the #include line because the forum editor seems to drop everything between < and >.

supersonic · June 5, 2011

Hi water,

ohhh... it was my fault... :huh2:

Now the script itself runs fine...

'_AD_ListDomainControllersEX()' returns @error = 1.

Greets,

-supersonic.

Edited June 5, 2011 by supersonic

water · June 5, 2011

Hi supersonic,

that's fine but @error = 1 means "No Domain Controllers found". That's caused by a typo in the _AD_ListDomainControllersEX function and causing it to just query Read-Only Domain Controllers.

Could you please replace line

$oAD_Command.CommandText = ";(objectClass=nTDSDSARO);ADsPath;subtree"

with

$oAD_Command.CommandText = ";(objectClass=nTDSDSA);ADsPath;subtree"

Edited June 5, 2011 by water

supersonic · June 5, 2011

I'll test it tomorrow morning. I hope you can wait until then... :huh2:

supersonic · June 6, 2011

Hi water,

still no luck (@error = 1) after changing the requested script line...

Greets,

-supersonic.

water · June 6, 2011

Hi supersonic,

very, very strange.

OK, here is the most current version of the example script.

If this still returns @error = 1 then could you please run the examples cript for _AD_ListDomainControllers?

#include <ad.au3>
_AD_Open()
$aDC = _AD_ListDomainControllersEX()
MsgBox(0,"", "_AD_ListDomainControllersEX Returncode: " & @error)
_ArrayDisplay($aDC)
_AD_Close()

Func _AD_ListDomainControllersEX($fAD_ListRO = False)

    Local $oAD_DC, $oAD_Site, $oAD_Result
    Local Const $NTDSDSA_OPT_IS_GC = 1
    $oAD_Command.CommandText = "<LDAP://" & $sAD_Configuration & ">;(objectClass=nTDSDSA);ADsPath;subtree"
    If $fAD_ListRO Then $oAD_Command.CommandText = "<LDAP://" & $sAD_Configuration & ">;(objectClass=nTDSDSARO);ADsPath;subtree"
    Local $oAD_RecordSet = $oAD_Command.Execute
    If Not IsObj($oAD_RecordSet) Or $oAD_RecordSet.RecordCount = 0 Then Return SetError(1, 0, "")
    ; The parent object of each object with objectClass=nTDSDSA is a Domain
    ; Controller. The parent of each Domain Controller is a "Servers"
    ; container, and the parent of this container is the "Site" container.
    $oAD_RecordSet.MoveFirst
    Local $aAD_Result[1][7], $iCount1 = 1, $aAD_SubNet, $aAD_Temp, $sAD_Temp
    Do
        ReDim $aAD_Result[$iCount1 + 1][7]
        $oAD_Result = _AD_ObjGet($oAD_RecordSet.Fields("AdsPath" ).Value)
        $oAD_DC = _AD_ObjGet($oAD_Result.Parent)
        $aAD_Result[$iCount1][0] = $oAD_DC.Get("Name")
        $aAD_Result[$iCount1][1] = $oAD_DC.serverReference
        $aAD_Result[$iCount1][2] = $oAD_DC.DNSHostName
        $oAD_Result = _AD_ObjGet($oAD_DC.Parent)
        $oAD_Site = _AD_ObjGet($oAD_Result.Parent)
        $aAD_Result[$iCount1][3] = StringMid($oAD_Site.Name, 4)
        $aAD_Result[$iCount1][4] = $oAD_Site.distinguishedName
        $aAD_SubNet = $oAD_Site.GetEx("siteObjectBL")
        For $iCount2 = 0 To UBound($aAD_SubNet) - 1
            $aAD_Temp = StringSplit($aAD_SubNet[$iCount2], ",")
            $sAD_Temp = StringMid($aAD_Temp[1], 4)
            If $iCount2 = 0 Then
                $aAD_Result[$iCount1][5] = $sAD_Temp
            Else
                $aAD_Result[$iCount1][5] = $aAD_Result[$iCount1][5] & "," & $sAD_Temp
            EndIf
        Next
        ; Is the DC a GC? Taken from: http://www.activexperts.com/activmonitor/windowsmanagement/adminscripts/computermanagement/ad/
        Local $oAD_DCRootDSE = _AD_ObjGet("LDAP://" & $oAD_DC.DNSHostName & "/rootDSE")
        Local $sAD_DsServiceDN = $oAD_DCRootDSE.Get("dsServiceName")
        Local $oAD_DsRoot  = _AD_ObjGet("LDAP://" & $oAD_DC.DNSHostName & "/" & $sAD_DsServiceDN)
        Local $iAD_DCOptions = $oAD_DsRoot.Get("options")
        If BitAND($iAD_DCOptions, $NTDSDSA_OPT_IS_GC) = 1 Then
            $aAD_Result[$iCount1][6] = True
        Else
            $aAD_Result[$iCount1][6] = False
        EndIf
        $oAD_RecordSet.MoveNext
        $iCount1 += 1
    Until $oAD_RecordSet.EOF
    $oAD_RecordSet.Close
    $aAD_Result[0][0] = UBound($aAD_Result, 1) - 1
    $aAD_Result[0][1] = UBound($aAD_Result, 2)
    Return $aAD_Result

EndFunc   ;==>_AD_ListDomainControllers

water · June 6, 2011

Hi supersonic,

at the moment I'm collecting ideas how to implement the global catalog search function. That's what I have so far:

The domain search function is named _AD_GetObjectsInOU. I don't like the name but to be consistent I could name the GC search function _AD_GetObjectsInGC
I'm going to use the connection opened with _AD_Open (including credentials if specified) and connect to the default or given domain controller. If this domain controller is no GC an error will be returned
You can pass a GC you wish to connect to as parameter to the GC search function

Some issues I want to discuss:

Do you think additional functions need to access the global catalog? Like _AD_GetObjectAttribute or _AD_GetPasswordExpired?
Do you want to connect to the domain and the Global Catalog at the same time? Or can we add a parameter to _AD_Open that specifies the access type? This has the advantage that all AD functions (at least the query functions should work witht he GC)
Do you think different credentials (opposed to those used in _AD_Open) might be needed to access the GC catalog?

The needs of you and other users have a big effect on the design. Edited June 6, 2011 by water

supersonic · June 6, 2011

Hi water,

the current/last version of '_AD_ListDomainControllersEX()' works like expected. Thank you for that! :huh2:

- To name the seach function '_AD_GetObjectsInGC()' sounds okay for me. '_AD_GetObjectsInOU()' doesn't sound bad either.

- If a domain controller has no GC you can't query it? Currently with V0.43 this works.

If a domain controller has no GC and you query it then the "Non-GC-DC" passes the query to another DC with a GC.

May be I got you wrong? Please, can you explain a bit more?

- What do you mean with "You can pass a GC..."?

There is only one GC in each (sub-)domain; each domain controller can (not must) store the GC.

Do you mean GC = DC?

- I think it could be too complicated to access the GC with different creds.

You should access the GC with the same creds for calling '_AD_Open()'.

Thank you so far,

-supersonic.

Edited June 6, 2011 by supersonic

water · June 6, 2011

Hi supersonic,

In a forest there can be multiple GCs. A GC is a DC that has an additional database to hold the information about the forest. On every DC there is at least the database for the domain. In addition the machine can have a second database as GC.

You can access a GC in two ways:

Replace LDAP:// with GC:// or access the machine where the DC is located on a different port with LDAP:// (that's what I'm going to do because the UDF has to be changed only in _AD_Open).

If I try to access a machine that isn't a GC then I will get an error because no one listens on the port specified (at least I think so).

What do you mean with "You can pass a GC..."?

Now you can pass the hostname of the DC you want to connect to to _AD_Open (4th parameter). This will be true for the GC as well. If you don't specify a GC _AD_Open will select one for you.

At the moment I think i will extend the UDF as follows:

_AD_Open gets an additional parameter to indicate that you want connect to a GC. This means that all function calls now access the GC (I'm not sure if this works well but this needs to be tested)
No _AD_GetObjectsInGC will be necessary. When connected to a GC _AD_GetObjectsInOU should work just fine
This means you can't work with a DC and a GC at the same time. You have to do _AD_Open, _AD_Close to switch between GC and DC

Does this make sense?

supersonic · June 6, 2011

Hi water,

summarized (just to make sure we're talking about the same issue):

- A DC could store a copy of the GC.

- If you query a DC without a GC, the query will be passed to another DC keeping a copy of the GC.

- The GC represents the forest the DC belongs to.

Am I right?

Your suggestion of how to extend the UDF makes sense to me. :huh2:

Greets,

-supersonic.

Edited June 6, 2011 by supersonic

Bert · June 6, 2011

I just downloaded and tried a few things. NICE WORK! :huh2:

water · June 6, 2011

Glad you like it :huh2:

I "beautified" the existing UDF written by John Clelland and added some functions requested by users (and me). Therefore it's a mixture of different programming styles and not as clean as if I had written it from scratch.

But users seem to be happy with it.

water · June 6, 2011

Hi water,
summarized (just to make sure we're talking about the same issue):
- A DC could store a copy of the GC. Correct
- If you query a DC without a GC, the query will be passed to another DC keeping a copy of the GC. If I query dc.microsoft.com:3268 (the GC should listen at this port) and there is no GC on this machine I will get an error
- The GC represents the forest the DC belongs to. Correct
Am I right?
Your suggestion of how to extend the UDF makes sense to me.
Greets,
-supersonic.

Hi supersonic,

find my comments above. That's how I understand GC at the moment.

How many query functions work when run against a GC will have to be tested.

I will create some test scripts and post them.

Edited June 6, 2011 by water

water · June 7, 2011

Version 1.0.0 has been released.

Please test before using in production!

For download please see my signature.

Sign In

Active Directory UDF

Recommended Posts

water

Top Posters In This Topic

Top Posters In This Topic

Popular Posts

water

BrewManNH

mnorland

Posted Images

water

water

supersonic

water

supersonic

water

supersonic

water

supersonic

supersonic

water

water

supersonic

water

supersonic

Bert

water

water

water

Similar Content

adding a variable inside a PowerShell command

AD - Active Directory UDF

Compare Active Directory Groups

Using the PowerShell Group Policy Module with AutoIt

Active Directory - Need to search where user is/was logged

Browse

AutoIt Resources

Release

Beta