Active Directory UDF

[colombeen]

do you know how to change the policy and what the specific name of the policy is?

[water]

Searching the web for "windows trusted location" returns something like this.

[colombeen]

strange... I've been looking but I haven't found anything specific on this topic that is not related to MS office

[colombeen]

Another question... is there a way to check the real last logon time? not the one that is stored on 1 DC but a check on every DC to see what is the last logon time?

[water]

Yes. There is a GetLastLogin function that queries all DCs for the last login date.

[colombeen]

thx didn't see that :-)

[ludoo]

hi,
thank you for this great UDF on the Active Directory management
is attempting to use the _AD_SetAccountExpire function, it's a shame we can not use the variable: GUICtrlCreateDate
thank you for your help.

[water]

How LDAP accepts dates is still a mystery to me. Different date formats in the US and Europe make it even more complex

[ludoo]

yes ,

I use the date format europe (France), it is converted into the US date format? or it comes from Active Directory, in all it's not easy

[JLogan3o13]

I use something similar, and basically you simply need to split out the string and then convert appropriately. I do something like this:

$aSplit = StringSplit(GUICtrlRead($myDate), ", ")

...and then convert each element to a variable (month, day, year). Then just plug that into your _AD_SetAccountExpire call.

 

Edit: Didn't think about the international formats. You know we Americans think it's all about us

Edited October 23, 2014 by JLogan3o13

[water]

Unfortunately I couldn't find a good docu about acceptable date formats

Edited October 28, 2014 by water

[colombeen]

Maybe this can help :

- http://www.epochconverter.com/epoch/ldap-timestamp.php

- http://www.mathworks.com/matlabcentral/fileexchange/14506-convert-time-to-windows-nt-format/content/convert2NTtime.m

- http://www.esqsoft.com/javascript_examples/date-to-epoch.htm

the last 2 have functions to convert from or to epoch timestamp

Edited October 28, 2014 by colombeen

[water]

Thanks a lot for the links but this kind of problem has already been solved

I referred to functions such as _AD_SetAccountExpire and the different date/time formats they accept.

 

Use the following syntax for the date/time:
    01/01/1970 = never expire
    yyyy-mm-dd hh:mm:ss= "international format" - always works
    xx/xx/xx <time> = "localized format" - the format depends on the local date/time settings

[Kovacic]

Unfortunately I couldn't find a good docu about acceptable date formats

 

I have been using something like this:

$xpire = @YEAR & "-" & @MON & "-" & @MDAY & " " & @HOUR & ":" & @MIN & ":" & @SEC
$user = "JSMith"


_AD_SetAccountExpire($user, $xpire)

Ofcourse you can do something like @MON + 3 or something like that..

[Kovacic]

On an unrelated but related topic, I was looking for a function that I could feed a display name to, and get back the SamAccountName... I didnt see anything that I could use, so I fabricated this:

Func SAMFromDisplayname($DisplayName)
    Local $objCommand = ObjCreate("ADODB.Command")
    Local $objConnection = ObjCreate("ADODB.Connection")
    $objConnection.Provider = "ADsDSOObject"
    $objConnection.Open("Active Directory Provider")
    $objCommand.ActiveConnection = $objConnection
    Local $strBase = "<GC://dc=" & $Domain & ",dc=COM>"
    Local $strFilter = "(&(objectCategory=person)(objectClass=user)(displayName=" & $DisplayName & "))"
    Local $strAttributes = "cn,sAMAccountName,displayName,sn,distinguishedName"
    Local $strQuery = $strBase & ";" & $strFilter & ";" & $strAttributes & ";subtree"
    $objCommand.CommandText = $strQuery
    $objCommand.Properties("Page Size") = 100
    $objCommand.Properties("Timeout") = 30
    $objCommand.Properties("Cache Results") = False
    $ADS_SCOPE_SUBTREE = 2
    $objCommand.Properties("searchscope") = $ADS_SCOPE_SUBTREE
    Local $objRecordSet = $objCommand.Execute
    return $objRecordSet.Fields("sAMAccountName").Value
EndFunc   ;==>getusersfromAD

Not sure if its anything you could use but I thought I would just post it.

[water]

Thanks for this function.

I only had a quick look at it (I'm on vacation right now) but I think _AD_GetObjectsInOU does the same. Right?

[willxing]

Great Script, helps a lot.

before I got this, I was ready to compile dsquery and dsmod to user's desktop.

now I can make script to let user to change their password without any domain tools.

PS, we have 3 different domains, it's always painful to create one user on different DC, now one click can done all the job. Cool~

[water]

I'm glad you like the UDF

[jcpetu]

Hi Willxin, excuse my curiosity, but how do you allow the user to change his password? would you share it?

thanks a lot and regards.

[willxing]

the idea is:

first you need create a group for safety, then make a user A join this group.

assign group to manager change password, but not allow to create or delete object.

 

in script:

obtain @logondomain to check if user are log in domain or local.

_ad_open with that user A

GUIcreate to let user input new password

no GUI for user to input username, obtain username by @Username

then _AD_SetPassword($user,$password)

some user have two domain, one is company's domain, and other is exchange server domain which manager by Top company group.

exchange server domain only have one account for us to add and modify account.

then use this one, user can modify their "own" password and email password, and can one click modify both as same password with unlock.

if something wrong, you just need kick UserA out of the group.

you can also make script write log to a file on server, then you can have log of who is always changing his password and what that password is.  :evil