Active Directory UDF

[BrewManNH]

In the first listing, there wasn't a "Computers" OU showing, which is why tried it with just the OU name in the function. "Computers" is a default OU created when Active Directory is loaded onto a DC which is why I was surprised to not see it on the listing in the first example. The jpg is a listing of the AD with all OUs showing. Here's what I get in _ArrayDisplay when I run the first example.

[1]|030 Accounts|OU=030 Accounts,DC=030-Academic,DC=local

[2]|Domain Controllers|OU=Domain Controllers,DC=030-Academic,DC=local

[3]|IT Administration|OU=IT Administration,DC=030-Academic,DC=local

[4]|PVS|OU=PVS,DC=030-Academic,DC=local

[5]|Workstations|OU=Workstations,DC=030-Academic,DC=local

[6]|Workstations\Instructor PCs|OU=Instructor PCs,OU=Workstations,DC=030-Academic,DC=local

[7]|Workstations\Student PCs|OU=Student PCs,OU=Workstations,DC=030-Academic,DC=local

Most of the default OUs aren't showing in this list.

[water]

I checked our AD and the mystery is solved

Function _AD_GetAllOUs does exactly what the name tells. It lists all OUs (Organizational Units) - but not CN (Containers). The LDAP queries the AD for "(objectCategory=organizationalUnit)".

Should I enhance the function so you can search for OU, CN or both?

[BrewManNH]

I hadn't realized that before. I had to Google the difference between the 2 of them to figure it out.

Without changing the current function, how would you go about listing the containers "CN=??" or the contents of a container with this UDF, or is it even possible? The only reason I ask is because when you create a new computer account, it (by default) goes into the Computers container, and there might be a case where I need to move a computer from there without knowing its name beforehand.

[water]

This should list all containers:

#include <AD.au3>
_AD_Open()
$aObjects = _AD_GetObjectsInOU("", "(objectCategory=container)", 2, "distinguishedName")
If @error > 0 Then
    MsgBox(64, "Active Directory Functions - Example 1", "No containers could be found")
Else
    _ArrayDisplay($aObjects, "Active Directory Functions - Example 1 - Containers")
EndIf

[water]

To get a list of all computers in container "Computers" I would try this:

#include <AD.au3>
_AD_Open()
$aObjects = _AD_GetObjectsInOU("CN=Computers,DC=030-Academic,DC=local", "(objectCategory=computer)", 2, "distinguishedName")
If @error > 0 Then
    MsgBox(64, "Active Directory Functions - Example 1", "No conputers could be found")
Else
    _ArrayDisplay($aObjects, "Active Directory Functions - Example 1 - Computes in container 'Computers'")
EndIf

[BrewManNH]

Yup, just figured that out myself, just had to basically change the OU= to CN= and put the correct filter in there, which I had somehow forgotten to add, and it all works good now.

[JLogan3o13]

I've been following the thread in help and support right now concerning Unjoining a machine from the domain. I had a curiosity question, but didn't want to hijack the thread. One of my customers has a very slow replication link between a couple of out of state DC's. This has caused issues in the past with deleting PCs from the domain and then quickly adding them back; when the outlying DC's finally catch up, they delete the PC again and cause a mess.

Currently when I disjoin a PC from AD I use WMI and loop through all DC's, deleting on each in turn. The script works, but is larger than I'd like. Just curious if there is an easier way to accomplish this with AD_UnJoinDomain; touching at least one DC in the main site and one in the outlying site.

[water]

If you have a look at the code of function _AD_UnJoinDomain you will see that the function does the same. It uses WMI to unjoin the computer and disable the computer account.

Using the preceding _AD_Open you can decide which DC you want to connect to.

So I think it should be possible to shorten your script but I'm not sure it's worth the effort because the script you have now works too.

[water]

Hi HaeMHuK,

Here's my first try for an enhanced version of _AD_Example_GetOUTreeView.

I've added additional parameters so you now can pass the categories you want to get the numbers for (user, computer, group ...), a text including the number that should be displayed right to the OU name and the search scope (number of objects in the OU or number of objects in the complete sub-tree).

Please give it a try and tell me how you like the result.

Tested with the latest AutoIt Beta version 3.3.9.4.

<Code moved to the next post>

Edited May 16, 2012 by water

[water]

Enhanced version. Allows select a single category (computer, user ..) by name or pass the complete LDAP query string.

[HaeMHuK]

Looks great. Thanks a lot.

[water]

I noticed one problem which will be fixed with the next version of the UDF.

If there are no objects in the OU you don't get 0 but "". That's a bug and will be fixed.

If you use $iAD_SearchScope = 2 the function searches the whole subtree for every OU - this might take some time.

If it's too slow I might change the code to a recursive approach.

[Akarillon]

Got this @error message after trying to use _AD_Open.

Function _AD_Open encoutered a problem. @error = 1326, @extended = 0

And I could not find that error message in your help files or the forum.

Is this a combined error? (1,3,2 and 6) or am I just stupid?

Been trying to adjust your example script.

This is the top part of it before it fails.

expandcollapse popup

#Region ;**** Directives created by AutoIt3Wrapper_GUI ****
#AutoIt3Wrapper_Outfile_x64=..\Compilation\DeloitteADController.exe
#AutoIt3Wrapper_Compression=4
#AutoIt3Wrapper_UseX64=y
#EndRegion ;**** Directives created by AutoIt3Wrapper_GUI ****
#include <AD.au3>
#include <ButtonConstants.au3>
#include <GUIConstantsEx.au3>
#include <WindowsConstants.au3>
#include <StaticConstants.au3>
#include <EditConstants.au3>


#Region ### START Koda GUI section ### Form=
$Form1 = GUICreate("Form1", 262, 145, 193, 124)
GUICtrlCreateInput("Username", 112, 24, 121, 21)
GUICtrlCreateInput("Password", 112, 64, 121, 21, BitOR($GUI_SS_DEFAULT_INPUT,$ES_PASSWORD))
$Username = GUICtrlCreateLabel("Username", 24, 24, 52, 17)
$Password = GUICtrlCreateLabel("Password", 24, 64, 50, 17)
$Login = GUICtrlCreateButton("Login", 24, 104, 75, 25)
$Cancel = GUICtrlCreateButton("Cancel", 160, 104, 75, 25)
GUISetState(@SW_SHOW)
#EndRegion ### END Koda GUI section ###

$a = 0

While $a = 0
$nMsg = GUIGetMsg()
Switch $nMsg
Case $GUI_EVENT_CLOSE
Exit
Case $Cancel
Exit
Case $Login
$a = 1
EndSwitch
WEnd

$sAD_UserIdParam = 0
$sAD_DNSDomainParam = 0
$sAD_PasswordParam = 0

_AD_Open($sAD_UserIdParam = ' & $Username & ', $sAD_PasswordParam = ' & $Password & ')
If @error Then Exit MsgBox(16, "Active Directory Example Script", "Function _AD_Open encountered a problem. @error = " & @error & ", @extended = " & @extended)

[water]

That's easy

Replace line

_AD_Open($sAD_UserIdParam = ' & $Username & ', $sAD_PasswordParam = ' & $Password & ')

with

_AD_Open($Username, $Password)

[Akarillon]

That's easy

Replace line

_AD_Open($sAD_UserIdParam = ' & $Username & ', $sAD_PasswordParam = ' & $Password & ')

with

_AD_Open($Username, $Password)

Ofc:P

So I am just stupid!

Thanks^^

[water]

No comment

[Akarillon]

No comment

Actually did not work

But I discovered this worked..

_AD_Open($sAD_UserIdParam = '' & $Username & '', $sAD_PasswordParam = '' & $Password & '')

[water]

What you posted is just the description of the syxntax.

What returncode do you get when you use

_AD_Open($Username, $Password)

[Akarillon]

What you posted is just the description of the syxntax.

What returncode do you get when you use

_AD_Open($Username, $Password)

Function _AD_Open encoutered a problem. @error = 1326, @extended = 0

[water]

Which version of the UDF and which operating system do you run?