Active Directory UDF

[Kovacic]

History.txt

* If you try to delete an object with characters that need to be escaped in the CN then function _AD_DeleteObject will crash.
  Thanks to user bartekd for pointing me to this error

I thought I helped out with that one

[water]

That was a similar but different problem.

bartekd found a problem with escaping special characters in a FQDN, you found a problem with special charactrers in an LDAP query..

I've now added the following line:

 

* _AD_FixSpecialChars only escaped special characters for FQDN. Didn't work for special characters in LDAP queries (as used in _AD_RemoveUserFromGroup and others).
  Thanks to Kovacic for pointing me to this problem.

[Kovacic]

That was a similar but different problem.

bartekd found a problem with escaping special characters in a FQDN, you found a problem with special charactrers in an LDAP query..

I've now added the following line:

 

haha thanks and sorry about that :]

BTW working on yet another app that uses that! Much thanks!

[water]

[crumpuppet]

Hi water, thanks for making this fantastic UDF.

I've got a question about getting info from multiple AD objects. This might be more of an AD question than an AutoIT question, but what is the most efficient way of getting object properties in bulk?

I'm making a program that pulls some basic properties for all items in a selected group - "samaccountname,givenname,sn,userAccountControl,objectcategory". I am iterating through each object and calling _AD_GetObjectProperties on each object, but the speed is not great. I did some tests with TimerDiff. From a remote site, each object takes an average of 230ms; 250 objects totalling about 1 minute. From the same LAN as the DC, the same query averages 84ms per object, total 17 seconds.

Is there not a better way of querying all of these objects in one connection? It must be possible, otherwise how does the AD Users & Computers MMC Snap-in get this data so quickly

Looking forward to any input!

[water]

Use function _AD_GetObjectsInOU.

This lets you specify the OUs to search, the objects to query (lets say just computers) and the properties to be returned. Please see the _AD_GetObjectsInOU.au3 example script.

[crumpuppet]

Use function _AD_GetObjectsInOU.

This lets you specify the OUs to search, the objects to query (lets say just computers) and the properties to be returned. Please see the _AD_GetObjectsInOU.au3 example script.

 

Great, this works MUCH faster. I'll have to rebuild a lot of my search functions, but the speed increase is significant and totally worth it. I had to force myself to get to grips with LDAP search queries, but after a few tries I managed to replicate the functionality I had before.

Thanks a million!

This makes me wonder though, is the _AD_GetObjectProperties function deprecated? With the right query string you can make it do the same thing, but approx. 10 to 12 times faster. The output is slightly different, but that is trivial to fix with some formatting afterwards.

[water]

1.  _AD_GetObjectProperties can return ALL properties of an object (user, computer, group ...). You don't have to know the name.
2. The function translates all returned data into readable format (dates etc.)

So: Is it deprecated? No!

[water]

Just for the records:

_AD_GetObjectAttribute returns a single untranslated attribute for the named object

[denisaurus]

One more bug: _AD_HasUnlockResetRights allways returns 0... I can see that you moved a bigger part of the function into _AD_HasRequiredRights so I guess that's the one that should be scrutinized.

[water]

Thanks, will have a look tomorrow.

[water]

One question:

What is the value of @extended when 0 is being returned?

[denisaurus]

It was allways @error=1, @extended=0, $iResult=0 but I think I've located the problem:

I have this passwordchanger program of mine that i use on my regular AD account without permissions to change password, but the program connects with another credentials ( _AD_Open("theguywithcreds","theguywithcredspassword")) and it should unhide button "Change password" from the gui by checking account with _AD_HasUnlockResetRights.

The function looks like this:

Func _AD_HasUnlockResetRights($sObject, $sUser = @UserName)

Local $iResult = _AD_HasRequiredRights($sObject, $ADS_USER_UNLOCKRESETACCOUNT, $sUser = @UserName)

Return SetError(@error, @extended, $iResult)

 

EndFunc   ;==>_AD_HasUnlockResetRights

[denisaurus]

...sorry, here comes the rest:

the function should look like this:

Func _AD_HasUnlockResetRights($sObject, $sUser = @UserName)

 

Local $iResult = _AD_HasRequiredRights($sObject, $ADS_USER_UNLOCKRESETACCOUNT, $sUser) ; <<==change the last part to $sUser (remove ' = @UserName')

Return SetError(@error, @extended, $iResult)

 

EndFunc   ;==>_AD_HasUnlockResetRights

 

Hope that this can spare you some time 

[water]

Thanks, I've already located the bug and posted a solution on page 1

Thanks for taking the time and help me to enhance the UDF!

[legend]

_AD_HasFullRights is not working with the latest UDF, and the latest version of AutoIt. (3.3.10.2)

If I install AutoIt 3.3.8.1 and the UDF for 3.3.8.1, it works just fine.

I do got full administrator rights to the domain.

http://puu.sh/7smD5.png

[water]

Have you checked the bug report on page 1 of this thread? There is a known bug and a workaround described there.

Edited March 19, 2014 by water

[araneon]

Hi everyone!
Prompt how to use AD.au3 find information about the user!
Important "Description" field in the user properties in Active Directory.

[water]

Can you please post your question in the General Help & Support thread?

And please give us some more information about your problem.

[araneon]

The problem follows.
I have a form that would need to run my script when the user's domain, in my form inserted the user account that launched my script, the main criterion is the "Description" field in which we have prescribed AD Name Last Name First Name
I apologize for distorting the description of my problem, there is no knowledge of English, use Google translator.