Active Directory UDF

[water]

So it seems to be a problem with the script not with the AD UDF or Obfuscator.

Question #1: Why do you insert a Sleep after _AD_ModifyAttribute and _AD_MoveObject and display a progress bar? The operation has already been done!

Edited November 3, 2012 by water

[Iceman682]

To be fair I never said there was a problem with the AD UDF and I won't dare to question your valued experience and great AD UDF, just that I don't know why I'm getting different results after Obfuscator.

Regarding the progress bar, this is just cosmetic as I don't like the msgbox option.

What would you suggest?

[water]

Iceman682,

I have no problem suspecting a bug in the AD UDF. When you have a look at the history you will see a lot of bugs had to be removed.

We just need to make sure not to search in the wrong direction. As the reproducer works successfull we can exclude the UDF. So the obfuscator or your script remains.

I would strip down your script to the "bare necessities", then remove some comments, test again until the wrong result appears again.

BTW: Is this correct: $ssComputer or should it only be one "s"?

expandcollapse popup

; Change attribute
$iValue = _AD_ModifyAttribute($ssComputer & "$", "description", $sDescription)
If $iValue = 1 Then
;    ProgressOn("Please Wait...", "Updating Computer Description in AD.", "Updating...")
;    For $i = 0 To 100
;        ProgressSet($i)
;       Sleep(5)
;    Next
;    ProgressSet(100, "Done!")
;    Sleep(3000)
;    ProgressOff()
ElseIf @error = 1 Then
    MsgBox(64, "Active Directory Error", "Unable to update description as Computer does not exist in AD!")
Else
    MsgBox(64, "Active Directory Error", "Computer is already in Active Directory!")
EndIf
; Move object
$iValue = _AD_MoveObject($sOU, $sObject)
If $iValue = 1 Then
;    ProgressOn("Please Wait...", "Moving Computer to the requested OU.", "Moving...")
;    For $i = 0 To 100
;      ProgressSet($i)
;       Sleep(5)
;    Next
;    Local $rc = _RunDos("Gpupdate /force")
;    ProgressSet(100, "Move Complete!")
;    Sleep(3000)
;    ProgressOff()
ElseIf @error = 1 Then
    MsgBox(0, "", "")
ElseIf @error = 2 Then
    MsgBox(64, "Active Directory Error", "Unable to move as Computer does not exist in AD!")
Else
    MsgBox(64, "Active Directory Error", "Unable to move as Computer is already in that OU!")
EndIf
_AD_Close()
GUIDelete($hMain)

Edited November 3, 2012 by water

[Iceman682]

Water

If it's not the Obfuscator why do I get the same errors when both your _AD_MoveObject.au3 and _AD_ModifyAttribute.au3 are compliled with Obfuscator?

When compiled without Obfuscator they work fine.

Edited November 3, 2012 by Iceman682

[water]

Never heard of any problem with Obfuscator and my AD UDF.

Can you post the Obfuscator settings (F7 in SciTE, then tab Obfuscator) plus the SciTE console when you compiled?

[Iceman682]

All I do is Ctrl+F7, selected a target location on the Autoit3/Aut2Exe tab, select the Obfuscator tab and put a tick in the box then press compile script.

Like I said I don't think there's anything wrong with the script(s)

Don't know if this helps, Obfuscator version 1.0.30.1

Edited November 3, 2012 by Iceman682

[water]

Ooopppsss.

I just tried to compile _AD_ModifyAttribute with the default settings for Obfuscator and got lots of errors in the SciTE console.

I then set "Obfuscator Parameters:" to "/striponly" and the errors went away.

Could you please set the Obfuscator parameters to "/striponly" too and then test again?

[water]

As soon as you set the encryption parameters to off the problem went away: "/cn 0 /cs 0"

[Jos]

One thing that could be of influence on this testing:

You cannot test @error this way and expect it still to be set to the result of _AD_ModifyAttribute() after Obfuscation.

You need to save the @error result into a variable for keeping it for later reference.

Jos

[water]

Thanks Jos for this clarification!

Didn't know that Obfuscator can change the "logic" of a script.

Is this true for all Obfuscator parameters?

[Jos]

It doesn't really change the logic, but in this case you are lucky that @error survives the number of lines. Best practice for keeping the @error and @extended values is to save them in a variable right after the Function is performed.

Run this example and also run it after obfuscation. It demonstrates that @error and @extended doesn't work properly anymore after full obfuscation:

$retval = Example()
ConsoleWrite('@@ Debug(' & @ScriptLineNumber & ') : $retval = ' & $retval & ' Error code: ' & @error & ' Extended code: ' & @extended & @crlf) ;### Debug Console
;
Func Example()
SetError(4,5)
Return 1
EndFunc

Jos

Edited November 3, 2012 by Jos

[Iceman682]

Looks like the issue has gone away with the /striponly parameter. I though I was going crazy. thanks Water for your perseverance.

Edited November 3, 2012 by Iceman682

[Jos]

@Water,

Here is an example how this problem could be avoided with Obfuscator:

;
;This loses @Error and @Extended obfuscated
$retval = Example()
If @error = 4 Then
    ConsoleWrite('@@ Debug 1 (' & @ScriptLineNumber & ') : $retval = ' & $retval & '   Error code: ' & @error & '   Extended code: ' & @extended & @CRLF) ;### Debug Console
Else
    ConsoleWrite('@@ Debug ? (' & @ScriptLineNumber & ') : $retval = ' & $retval & '   Error code: ' & @error & '   Extended code: ' & @extended & @CRLF) ;### Debug Console
EndIf
;
;This works obfuscated
$retval = Example()
$err = @error
$ext = @extended
If $err = 4 Then
    ConsoleWrite('@@ Debug 1 (' & @ScriptLineNumber & ') : $retval = ' & $retval & '   Error code: ' & $err & '   Extended code: ' & $ext & @CRLF) ;### Debug Console
Else
    ConsoleWrite('@@ Debug ? (' & @ScriptLineNumber & ') : $retval = ' & $retval & '   Error code: ' & $err & '   Extended code: ' & $ext & @CRLF) ;### Debug Console
EndIf
;
Func Example()
    #Obfuscator_Off
    Return SetError(4, 5, 1)
    #Obfuscator_On
EndFunc   ;==>Example

Jos

[water]

I'm famous for my perseverance - at least in a small part of the universe

But I have learned something new today as well - it was worth the effort

[water]

Jos,

thanks for the example. I played a bit and noticed that I'm save as long as I just use /striponly.

I've never used anything else and it seems nobody else has done because I haven't got any complaints from users of my UDFs.

Thank you very much for the insight!

[lewisg]

Is it possible to retrive a list of AD Groups without including the System Objects Groups......i.e. Domain Admins, DnsAdmins, Cert Publishers, etc?

I'm using:

$aGroups = _AD_GetObjectsInOU("", "(objectclass=group)", 2)

Thanks

[water]

Unfortunaely I don't know how to distinguish a system group from a user group.

Could you start to search for groups in a specific OU to exclude the builtin groups?

[lewisg]

I'll check to see if a specific OU will work, wanted to keep the code as generic as possible, however if it can't been done, so be it, I'll work around it best I can. Thanks for the quick reply, I just didn't want to waste time searching and testing for an unavailable solution.

BTW in some earlier post I think you said you didn't have an AD system at home to test things on. I setup a VM running a Resara server, basically a Linux Ubuntu preconfigure with Samba 4 and an throttled down near clone of the AD we have have work. It took a little while to get everthing to play well together, but it's handy and works for me.

[water]

... however if it can't been done ...

I'm not sure it can't be done - but I just don't know how.

BTW in some earlier post I think you said you didn't have an AD system at home to test things on. I setup a VM running a Resara server, basically a Linux Ubuntu preconfigure with Samba 4 and an throttled down near clone of the AD we have have work. It took a little while to get everthing to play well together, but it's handy and works for me.

If you can provide the information how to set up such an environment I will be glad to do so. This will give me the opportunity to do more tests myself.

I have Ubuntu Linux with VirtualBox running here so setting up a virtual machine should be no problem.

[lewisg]

I'm not sure it can't be done - but I just don't know how.

If you can provide the information how to set up such an environment I will be glad to do so. This will give me the opportunity to do more tests myself.

I have Ubuntu Linux with VirtualBox running here so setting up a virtual machine should be no problem.

First.....I'm no expert and I got it working so your chances are very good for success.

I downloaded and installed the OAV image (I'm using VirtualBox also) and the Window version of Admin Console, I think the Linux version is included in the OAV.

The few "gottchas" I had was in the settings for VirtualBox, in the Network tab I set it to "Bridge Adapter" and my real phyical NIC. And in the setting for Resara I didn't setup DHCP or DNS.

The last thing was to set "C:\Windows\System32\drivers\etc\host" with the name(s) of the new AD.....192.168.0.201 adtest.my.lan ...... 192.168.0.201 my.lan ..... 192.168.0.201 my . Don't know which one does the job but it works.

I'm using Windows 7 as a WorkGroup for my main (first) login, from there I start the VM Resara server then switch user to a domin user I created in the VM AD.

I had tried making an AD with Samba4 on a VM Ubuntu from the ground up but it never quite worked correctly and for testing I wanted the AD out of the equation.

It works fine for me as a test area and I don't have to worry about trashing the work AD ....... probable cause for unemployment <Grin>.

Good luck