Active Directory UDF

[BullGates]

The latest one 1.2.0, and I use Windows 7 x64 (but compiling and running as x86 is the same).

[water]

Can you please insert "$iAD_Debug = 2" after "#include <AD.au3>" in the example script?

[BullGates]

Hello, I get this error:

COM error Encountered in _AD_GetLastLoginDate.au3

AD UDF version = 1.2.0

Scriptline = 1430

NumberHex = 80020009

Number = -2147352567

WinDescription =

Description = The directory property cannot be found in the cache.

Source = Active Directory

HelpFile =

HelpContext = 0

LastDllError = 0

[water]

This error is raised when the script tries to determine if the domain controller being processed has a Global Catalog in function _AD_ListDomainControllers.

How often does the error message pop up (just one time, multiple times, for every DC)?

About how many domain controllers do we talk here?

What versions: Windows NT, Windows 2000, W2K3, W2K8?

If you run the example script _AD_ListDomainControllers.au3 do you get the same error?

[BullGates]

Yes I get the same error with _AD_ListDomainControllers.au3. It takes about 30s to process and then I get the error. The error pops at every function, for _AD_ListDomainControllers it's 3 times.

We have around 30 domains, and every domain has at least 2 DC's, so it's around 60 DC's. The functional level is W2K3, I think we have W2K3 and W2K8, not bellow that.

[water]

But after all those error messages do you get a valid list of DCs when running _AD_ListDomainControllers.au3?

[BullGates]

No, never. I get this in the output of AutoIT:

C:Program Files (x86)AutoIt3IncludeAD.au3 (1428) : ==> Error in expression.:

Local $sAD_DsServiceDN = $oAD_DCRootDSE.Get("dsServiceName")

Local $sAD_DsServiceDN = ^ ERROR

->15:26:08 AutoIT3.exe ended.rc:1

>Exit code: 1 Time: 145.250

[water]

I've added some error checking code to the function. Could you please run this modified version to get a list of all DCs?

expandcollapse popup

Func _AD_ListDomainControllers($fAD_ListRO = False)

    Local $oAD_DC, $oAD_Site, $oAD_Result
    Local Const $NTDSDSA_OPT_IS_GC = 1
    $oAD_Command.CommandText = "<LDAP://" & $sAD_HostServer & "/" & $sAD_Configuration & ">;(objectClass=nTDSDSA);ADsPath;subtree"
    If $fAD_ListRO Then $oAD_Command.CommandText = "<LDAP://" & $sAD_HostServer & "/" & $sAD_Configuration & ">;(objectClass=nTDSDSARO);ADsPath;subtree"
    Local $oAD_RecordSet = $oAD_Command.Execute
    If Not IsObj($oAD_RecordSet) Or $oAD_RecordSet.RecordCount = 0 Then Return SetError(1, 0, "")
    ; The parent object of each object with objectClass=nTDSDSA is a Domain
    ; Controller. The parent of each Domain Controller is a "Servers"
    ; container, and the parent of this container is the "Site" container.
    $oAD_RecordSet.MoveFirst
    Local $aAD_Result[1][7], $iCount1 = 1, $aAD_SubNet, $aAD_Temp, $sAD_Temp
    Do
        ReDim $aAD_Result[$iCount1 + 1][7]
        $oAD_Result = _AD_ObjGet($oAD_RecordSet.Fields("AdsPath" ).Value)
        $oAD_DC = _AD_ObjGet($oAD_Result.Parent)
        $aAD_Result[$iCount1][0] = $oAD_DC.Get("Name")
        $aAD_Result[$iCount1][1] = $oAD_DC.serverReference
        $aAD_Result[$iCount1][2] = $oAD_DC.DNSHostName
        $oAD_Result = _AD_ObjGet($oAD_DC.Parent)
        $oAD_Site = _AD_ObjGet($oAD_Result.Parent)
        $aAD_Result[$iCount1][3] = StringMid($oAD_Site.Name, 4)
        $aAD_Result[$iCount1][4] = $oAD_Site.distinguishedName
        $aAD_SubNet = $oAD_Site.GetEx("siteObjectBL")
        For $iCount2 = 0 To UBound($aAD_SubNet) - 1
            $aAD_Temp = StringSplit($aAD_SubNet[$iCount2], ",")
            $sAD_Temp = StringMid($aAD_Temp[1], 4)
            If $iCount2 = 0 Then
                $aAD_Result[$iCount1][5] = $sAD_Temp
            Else
                $aAD_Result[$iCount1][5] = $aAD_Result[$iCount1][5] & "," & $sAD_Temp
            EndIf
        Next
        ; Is the DC a GC? Taken from: http://www.activexperts.com/activmonitor/windowsmanagement/adminscripts/computermanagement/ad/
        Local $oAD_DCRootDSE = _AD_ObjGet("LDAP://" & $oAD_DC.DNSHostName & "/rootDSE")
        If @error Then ContinueLoop
        Local $sAD_DsServiceDN = $oAD_DCRootDSE.Get("dsServiceName")
        If @error Then ContinueLoop
        Local $oAD_DsRoot = _AD_ObjGet("LDAP://" & $oAD_DC.DNSHostName & "/" & $sAD_DsServiceDN)
        If @error Then ContinueLoop
        Local $iAD_DCOptions = $oAD_DsRoot.Get("options")
        If @error Then ContinueLoop
        If BitAND($iAD_DCOptions, $NTDSDSA_OPT_IS_GC) = 1 Then
            $aAD_Result[$iCount1][6] = True
        Else
            $aAD_Result[$iCount1][6] = False
        EndIf
        $oAD_RecordSet.MoveNext
        $iCount1 += 1
    Until $oAD_RecordSet.EOF
    $oAD_RecordSet.Close
    $aAD_Result[0][0] = UBound($aAD_Result, 1) - 1
    $aAD_Result[0][1] = UBound($aAD_Result, 2)
    Return $aAD_Result

EndFunc   ;==>_AD_ListDomainControllers

[BullGates]

Now I get an huge quantity of error messages just like the error reported before, should I disable debug? I've clicked of dozens of times.

[water]

Yes, please disable debugging and lets see if we can get a complete list of DCs.

[BullGates]

Has been running for about 10 minutes without any output. Should I stop it?

Thank you for all your patience and support

[water]

Yes, please stop the script.

I will insert some debugging code and post a new test version.

[water]

The function to test for a Global Catalog is the newest code. Could you please insert comment statements so this code is disabled?

expandcollapse popup

Func _AD_ListDomainControllers($fAD_ListRO = False)

    Local $oAD_DC, $oAD_Site, $oAD_Result
;   Local Const $NTDSDSA_OPT_IS_GC = 1  ; <==
    $oAD_Command.CommandText = "<LDAP://" & $sAD_HostServer & "/" & $sAD_Configuration & ">;(objectClass=nTDSDSA);ADsPath;subtree"
    If $fAD_ListRO Then $oAD_Command.CommandText = "<LDAP://" & $sAD_HostServer & "/" & $sAD_Configuration & ">;(objectClass=nTDSDSARO);ADsPath;subtree"
    Local $oAD_RecordSet = $oAD_Command.Execute
    If Not IsObj($oAD_RecordSet) Or $oAD_RecordSet.RecordCount = 0 Then Return SetError(1, 0, "")
    ; The parent object of each object with objectClass=nTDSDSA is a Domain
    ; Controller. The parent of each Domain Controller is a "Servers"
    ; container, and the parent of this container is the "Site" container.
    $oAD_RecordSet.MoveFirst
    Local $aAD_Result[1][7], $iCount1 = 1, $aAD_SubNet, $aAD_Temp, $sAD_Temp
    Do
        ReDim $aAD_Result[$iCount1 + 1][7]
        $oAD_Result = _AD_ObjGet($oAD_RecordSet.Fields("AdsPath" ).Value)
        $oAD_DC = _AD_ObjGet($oAD_Result.Parent)
        $aAD_Result[$iCount1][0] = $oAD_DC.Get("Name")
        $aAD_Result[$iCount1][1] = $oAD_DC.serverReference
        $aAD_Result[$iCount1][2] = $oAD_DC.DNSHostName
        $oAD_Result = _AD_ObjGet($oAD_DC.Parent)
        $oAD_Site = _AD_ObjGet($oAD_Result.Parent)
        $aAD_Result[$iCount1][3] = StringMid($oAD_Site.Name, 4)
        $aAD_Result[$iCount1][4] = $oAD_Site.distinguishedName
        $aAD_SubNet = $oAD_Site.GetEx("siteObjectBL")
        For $iCount2 = 0 To UBound($aAD_SubNet) - 1
            $aAD_Temp = StringSplit($aAD_SubNet[$iCount2], ",")
            $sAD_Temp = StringMid($aAD_Temp[1], 4)
            If $iCount2 = 0 Then
                $aAD_Result[$iCount1][5] = $sAD_Temp
            Else
                $aAD_Result[$iCount1][5] = $aAD_Result[$iCount1][5] & "," & $sAD_Temp
            EndIf
        Next
#cs  ; <==
        ; Is the DC a GC? Taken from: http://www.activexperts.com/activmonitor/windowsmanagement/adminscripts/computermanagement/ad/
        Local $oAD_DCRootDSE = _AD_ObjGet("LDAP://" & $oAD_DC.DNSHostName & "/rootDSE")
        If @error Or Not IsObj($oAD_DCRootDSE) Then ContinueLoop
        Local $sAD_DsServiceDN = $oAD_DCRootDSE.Get("dsServiceName")
        If @error Then ContinueLoop
        Local $oAD_DsRoot = _AD_ObjGet("LDAP://" & $oAD_DC.DNSHostName & "/" & $sAD_DsServiceDN)
        If @error Or Not IsObj($oAD_DsRoot) Then ContinueLoop
        Local $iAD_DCOptions = $oAD_DsRoot.Get("options")
        If @error Then ContinueLoop
        If BitAND($iAD_DCOptions, $NTDSDSA_OPT_IS_GC) = 1 Then
            $aAD_Result[$iCount1][6] = True
        Else
            $aAD_Result[$iCount1][6] = False
        EndIf
#ce  ; <==
        $oAD_RecordSet.MoveNext
        $iCount1 += 1
    Until $oAD_RecordSet.EOF
    $oAD_RecordSet.Close
    $aAD_Result[0][0] = UBound($aAD_Result, 1) - 1
    $aAD_Result[0][1] = UBound($aAD_Result, 2)
    Return $aAD_Result

EndFunc   ;==>_AD_ListDomainControllers

Edited January 27, 2012 by water

[BullGates]

Now it worked, I see 420 DC's.

o^O

[water]

Thats fine! I think I need to implement another flag because the code to determine a Global Catalog needs to contact the DC. To contact 420 DCs takes a lot of time and might return an error if the DC can't be reached.

Could you please test this code:

expandcollapse popup

; #FUNCTION# ====================================================================================================================
; Name...........: _AD_ListDomainControllers
; Description ...: Enumerates all Domain Controllers (returns information about: Domain Controller, site, subnet and Global Catalog).
; Syntax.........: _AD_ListDomainControllers([$fAD_ListRO = FALSE[, $fAD_ListGC = FALSE]])
; Parameters ....: $fAD_ListRO - Optional: If set to True only returns RODC (read only domain controllers) (default = FALSE)
;                 $fAD_ListGC - Optional: If set to True queries the DC for a GC. Disabled for performance reasons (default = FALSE)
; Return values .: Success - One-based two dimensional array with the following information:
;                 |0 - Domain Controller: Name
;                 |1 - Domain Controller: Distinguished Name (FQDN)
;                 |2 - Domain Controller: DNS host name
;                 |3 - Site: Name
;                 |4 - Site: Distinguished Name (FQDN)
;                 |5 - Site: List of subnets that can connect to the site using this DC in the format x.x.x.x/mask - multiple subnets are separated by comma
;                 |6 - Global Catalog: Set to True if the DC is a Global Catalog (only if flag $fAD_ListGC = True. If False then "" is returned)
;                 Failure - "", sets @error to:
;                 |1 - No Domain Controllers found
; Author ........: water (based on VB functions by Richard L. Mueller)
; Modified.......:
; Remarks .......: This function only lists writeable DCs (default). To list RODC (read only DCs) use parameter $fAD_ListRO
; Related .......:
; Link ..........: http://www.rlmueller.net/Enumerate%20DCs.htm
; Example .......: Yes
; ===============================================================================================================================
Func _AD_ListDomainControllers($fAD_ListRO = False, $fAD_ListGC = False)

    Local $oAD_DC, $oAD_Site, $oAD_Result
    Local Const $NTDSDSA_OPT_IS_GC = 1
    $oAD_Command.CommandText = "<LDAP://" & $sAD_HostServer & "/" & $sAD_Configuration & ">;(objectClass=nTDSDSA);ADsPath;subtree"
    If $fAD_ListRO Then $oAD_Command.CommandText = "<LDAP://" & $sAD_HostServer & "/" & $sAD_Configuration & ">;(objectClass=nTDSDSARO);ADsPath;subtree"
    Local $oAD_RecordSet = $oAD_Command.Execute
    If Not IsObj($oAD_RecordSet) Or $oAD_RecordSet.RecordCount = 0 Then Return SetError(1, 0, "")
    ; The parent object of each object with objectClass=nTDSDSA is a Domain
    ; Controller. The parent of each Domain Controller is a "Servers"
    ; container, and the parent of this container is the "Site" container.
    $oAD_RecordSet.MoveFirst
    Local $aAD_Result[1][7], $iCount1 = 1, $aAD_SubNet, $aAD_Temp, $sAD_Temp
    Do
        ReDim $aAD_Result[$iCount1 + 1][7]
        $oAD_Result = _AD_ObjGet($oAD_RecordSet.Fields("AdsPath" ).Value)
        $oAD_DC = _AD_ObjGet($oAD_Result.Parent)
        $aAD_Result[$iCount1][0] = $oAD_DC.Get("Name")
        $aAD_Result[$iCount1][1] = $oAD_DC.serverReference
        $aAD_Result[$iCount1][2] = $oAD_DC.DNSHostName
        $oAD_Result = _AD_ObjGet($oAD_DC.Parent)
        $oAD_Site = _AD_ObjGet($oAD_Result.Parent)
        $aAD_Result[$iCount1][3] = StringMid($oAD_Site.Name, 4)
        $aAD_Result[$iCount1][4] = $oAD_Site.distinguishedName
        $aAD_SubNet = $oAD_Site.GetEx("siteObjectBL")
        For $iCount2 = 0 To UBound($aAD_SubNet) - 1
            $aAD_Temp = StringSplit($aAD_SubNet[$iCount2], ",")
            $sAD_Temp = StringMid($aAD_Temp[1], 4)
            If $iCount2 = 0 Then
                $aAD_Result[$iCount1][5] = $sAD_Temp
            Else
                $aAD_Result[$iCount1][5] = $aAD_Result[$iCount1][5] & "," & $sAD_Temp
            EndIf
        Next
        If $fAD_ListGC Then
            ; Is the DC a GC? Taken from: http://www.activexperts.com/activmonitor/windowsmanagement/adminscripts/computermanagement/ad/
            Local $oAD_DCRootDSE = _AD_ObjGet("LDAP://" & $oAD_DC.DNSHostName & "/rootDSE")
            Local $sAD_DsServiceDN = $oAD_DCRootDSE.Get("dsServiceName")
            Local $oAD_DsRoot = _AD_ObjGet("LDAP://" & $oAD_DC.DNSHostName & "/" & $sAD_DsServiceDN)
            Local $iAD_DCOptions = $oAD_DsRoot.Get("options")
            If BitAND($iAD_DCOptions, $NTDSDSA_OPT_IS_GC) = 1 Then
                $aAD_Result[$iCount1][6] = True
            Else
                $aAD_Result[$iCount1][6] = False
            EndIf
        Endif
        $oAD_RecordSet.MoveNext
        $iCount1 += 1
    Until $oAD_RecordSet.EOF
    $oAD_RecordSet.Close
    $aAD_Result[0][0] = UBound($aAD_Result, 1) - 1
    $aAD_Result[0][1] = UBound($aAD_Result, 2)
    Return $aAD_Result

EndFunc   ;==>_AD_ListDomainControllers

[BullGates]

Worked fine now! Thanks!

[BullGates]

Well but _AD_GetLastLoginDate() takes ages (it will query all the DC's to find the latest login, right?)

If I limit the search to my site it's ok, about 12s...

[water]

Right, that's why parameter $sAD_Site was implemented - to improve response time.

[HaeMHuK]

Hi water.

I've faced with one problem.

There is an error while deleting object.

Could you please look to attachments.

P.S.

http://mikemstech.blogspot.com/2011/12/active-directory-leaf-object-confirm.html

Edited February 23, 2012 by HaeMHuK

[water]

Could you please run your script with debugging set to on?

Please insert

$iAD_Debug = 2

after

#include <ad.au3>

and post the output you get.